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Abstract 

We present deterministic polynomially space bounded algorithms for the closest vector 
problem for all £p-norms, \ < p < oo, and all polyhedral norms, in particular for the ^i- 
norm and the ^oo-norm. For all £p-norms with 1 < p < cxd the running time of the algorithm 
is p ■ log2(r)^(i)n(2+o(i))", where r is an upper bound on the size of the coefficients of the 
target vector and the lattice basis and n is the dimension of the vector space. For polyhedral 
norms, we obtain an algorithm with running time {s\og2{r))^^^^vP'~^°^^'^^"' ^ where r and n 
are defined as above and s is the number of constraints defining the polytope. In particular, 
for the £i-norm and the £oo-iiorm, we obtain a deterministic algorithm for the closest vector 
problem with running time log2(r)'^*^^''n*^^+'''-^^^". 

We achieve our results by introducing a new lattice problem, the lattice membership problem: 
For a given full-dimensional bounded convex set and a given lattice, the goal is to decide 
whether the convex set contains a lattice vector or not. The lattice membership problem is 
a generalization of the integer programming feasibility problem from polyhedra to bounded 
convex sets. In this paper, we describe a deterministic algorithm for the lattice membership 
problem, which is a generalization of Lenstra's algorithm for integer programming. We 
also describe a polynomial time reduction from the closest vector problem to the lattice 
membership problem. This approach leads to a deterministic algorithm that solves the 
closest vector problem in polynomial space for all ^p-norms, 1 < p < oo, and all polyhedral 



1 Introduction 

In the closest vector problem (Cvp), we are given a lattice L and some target vector t in the 
R-vector space span(L) spanned by the vectors in L. We are asked to find a vector u £ L, whose 
distance to t is as small as possible. Since this problem can be defined for any norm on R", 
we stated this problem without referring to a specific norm. Often CvP as well as other lattice 
problems are considered with respect to the ^2-iiorm. However, it is also common to consider 
Cvp with respect to other non-Euclidean norms, for example in cryptography, see |Ngu01| , or in 
integer programming, see |Len83| . The most commonly used non- Euclidean norms are arbitrary 
£p-norms with 1 < p < oo. The ^p-norm of a vector x G K," is defined by = {Yl^=i \xi\^)^^^ 
for 1 < p < oo and ||x||oo = max{|a:i||l < i < n}. In general, a norm is defined by a convex body 
C symmetric about the origin via the function pc ■ R" — >■ R, Pci^) = inf{A > 0|x G A • C}. If the 
convex body is a bounded polyhedron P, i.e., a polytope, then we call the corresponding norm 
a polyhedral norm, denoted by || • \\p. Especially, the £i-norm and the ^oo-norm are polyhedral 
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norms. Therefore, we distinguish in the following between £p-norms with 1 < p < oo and 
polyhedral norms. 

Algorithms for Cvp In the last 30 years, the complexity of Cvp has been studied intensively. 
It is known that CvP with respect to all ^p-norms is NP-hard and even hard to approximate, see 
|vEB81) . IABSS93) . |DKS98) . |DKRSn3) . |RRn6) . |Pein8) . Furthermore, for any e > 0, there is a 
randomized reduction from CvP with approximation factor 1 + e with respect to the ^2-iiorm to 
the exact version of CvP with respect to the ^p-norm, see |RR06) . This suggests that CvP with 
respect to the ^2-iiorm is easier than CvP with respect to any other ip-norm. 

The best polynomial time approximation algorithms are based on the LLL-algorithm and achieve 
single exponential approximation factors. Basically, they work for the ^2-iiorm, but using 
Holder's inequality, we obtain results for all £p- norms, see |LLL82| . |Bab86| . |Sch87| . |Sch94| . 

In this paper, we focus on deterministic and exact algorithms for CvP with respect to arbitrary 
^p-norms. Therefore, in the sequel we ignore all probabilistic algorithms for CvP like the results 
based on the AKS sampling technique. Instead, we briefly review the existing deterministic 
algorithms for CvP with respect to the ^2-iiorm and discuss why it may be difficult or even 
impossible to generalize them to non-Euclidean norms. For a survey on these algorithms see 
IHPSll] . 

In a breakthrough paper, Micciancio and Voulgaris describe a deterministic, single exponential 
time algorithm that solves CvP with respect to the -^'2-norm exactly, see |MV10| . It is based 
on the computation of Voronoi cells of a lattice. The algorithm can be generalized to all norms 
whose unit ball is an ellipsoid as remarked in |DPVllj . Unfortunately, it seems that the C VP- 
algorithm of |MV10) cannot be generalized to other norms, since then the Voronoi cell of a lattice 
need not be convex. Moreover, the algorithm of Micciancio and Voulgaris requires exponential 
space. 

Basically, there exist two other deterministic algorithms for CvP with respect to the ^2-iiorm. 
Both algorithms require polynomial space, in particular, they work with numbers whose bit size is 
polynomially bounded in the input size. The algorithm of Kannan |Kan87) with its improvements 
by Helfrich |Hel85| and Hanrot and Stehle |HS07| uses at most 2'^(")n"/2 . log2(r)^(^) arithmetic 
operations, where n is the rank of the lattice and r is an upper bound on the coefficients used 
to describe the basis. Another algorithm that solves CvP optimally is due to Blomer |BloOO| . It 
uses n! log2(r)'-^(^) arithmetic operations. It may be difficult to generalize these two algorithms 
to non-Euclidean norms (although Kannan claims the opposite in his paper), since they both use 
orthogonal projections: At some point during the algorithm, they have to work with a target 
vector, which is not contained in the vector space spanned by the lattice. In this situation, 
they consider the orthogonal projection of the target vector onto the subspace spanned by the 
lattice. However, unlike the ^2-iiorm, for arbitrary ^p-norms the closest lattice vector to the 
target vector is not a closest lattice vector to the orthogonal projection of the target vector or 
vice versa. Also, if we use norm projections as defined in |Man9 9] or [LS92|. this is not true. 
We present a counterexample for both cases in the appendix, see Section lA.ll 

In this paper, we consider the lattice membership problem (Lmp), where we are given a 
full-dimensional bounded convex set together with a lattice and we want to decide whether the 
convex set contains a lattice vector. First, we show that for all £p- norms, 1 < p < oo, and all 
polyhedral norms, e. g. the ^i-norm and the ^oo-norm, there exists a polynomial time reduction 
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from CVP to Lmp. The reduction also preserved the dimension and the rank of the input lattice. 
Furthermore, we show that there exists a deterministic algorithm that solves Lmp in polyno- 
mial space for all £p-balls and polytopes. If we consider ip-noims, 1 < p < oo, we obtain an 
algorithm that uses p ■ log2(r)'^(i)n(2+°(i))'^ arithmetic operations and for all polyhedral norms 
an algorithm that uses {s ■ log2{r))''^^^'^n^'^~^°^^^^" arithmetic operations, where s is the number 
of constraints defining the polytope. For the £i-norm, we have s = 2" and for the ^oo-norm, we 
have s = 2n. Hence for these norms, we obtain a deterministic polynomial space algorithm us- 
ing log2(r)^''^)n^^'*'"''^'*^" arithmetic operations. Together with the reduction from CvP to Lmp, 
we obtain a deterministic algorithm that solves CvP for all ^p-norms and all polyhedral norms 
exactly in polynomial space. To the best of our knowledge, this is the first result of this type. 

The lattice membership problem is a generalization of the integer programming feasibility prob- 
lem and our algorithm is a variant of Lenstra's algorithm for integer programming used together 
with a variant of the ellipsoid method, see |Len83| . To guarantee that the algorithm runs in 
polynomial space, we use a preprocessing technique from Frank and Tardos |FT87) developed 
for Lenstra's algorithm for integer programming. To put our results in perspective, we shortly 
review in the following the major results based on Lenstra's technique. 

Lenstra's algorithm for integer programming and related results In 1979, Lenstra 
presented a polynomial time algorithm that solves the integer programming feasibility problem 
in fixed dimension |Len83| . which was improved by Kannan in 1987 |Kan87| . Using a further im- 
provement by Frank and Tardos |FT87) , the algorithm requires polynomial space and the number 
of arithmetic operations of this algorithm is O^n^^"^" log2(r)), where r is an upper bound on the 
size of the polyhedron. Hence, our result improves the running time of Lenstra's algorithm by 
the factor n"-/^. 

In 2005, Heinz generalized Lenstra's algorithm to obtain an algorithm for integer optimiza- 
tion over quasiconvex polynomials, which was improved by Hildebrand and Koppe (see |Hei05] . 
|HK10| ). Their results can be used to decide whether the set {x E 1R,"| — a < 0} contains a 
lattice vector, if p is an even number, since for p even, the function x i— )• ||2;||p is a quasiconvex 
polynomial. In this case, we obtain an algorithm for the lattice membership problem using at 
most log2(r)'-'(-'^^p'-^('^)n(^"'"°^"^-'^" arithmetic operations. By comparison, the number of arithmetic 
operations of our algorithm depends only linearly on the parameter p defining the norm. If p 
is not an even number, the function x i— )• is not even a polynomial and thus, the result of 
Heinz cannot be applied directly to achieve our results. 

Recently, Dadush, Peikert and Vempala presented in |DPV11| a randomized algorithm for Lmp 
for well-bounded convex bodies given by a separation oracle. The expected number of arithmetic 
operations of this algorithm is 0{n'^^^"')log2{r)'^^^\ This is also the case, if the convex bodies 
are generated by an ^p-norm or a polyhedral norm, see Theorem 4.7 in |DPV10| . In |DV12) . 
Dadush and Vempala derandomize this result without increasing the number of arithmetic op- 
erations. The number of arithmetic operations of their algorithm is better than ours. But the 
algorithm require exponential space whereas our algorithm requires only polynomial space. 

Organization The paper is organized as follows. In Section |2] we state some basic definitions 
and important facts used in this paper. In Section [3l we formally define the lattice membership 
problem and present a polynomial time reduction from CvP to Lmp for all £p-norms with 
1 < p < oo and all polyhedral norms. In Section |4l we describe Lenstra's algorithm as a general 
framework for algorithmic solutions of Lmp. Then, we adapt this framework to concrete classes 
of convex sets: In Section \5\ we consider polytopes and in Section |6l we consider the class of 
^p-bodies, where 1 < p < oo. In the description of the lattice membership algorithms we assume 
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that we have access to an algorithm that compute a flatness direction of the bounded convex set. 
In Section [Tj we describe how we can compute a flatness direction of a polytope or an ip-hody, 
which completes the description of the algorithm for Lmp. We view this section as the main 
technical contribution of our paper. 

2 Basic definitions and facts 

A polyhedron P is the solution set of a system of inequalities given by a matrix A £ H^^"^ and 
a vector /3 G R^, P = {x £ lR"|^x < /?}. In the following, we always assume that a polyhedron 
is given in this way. A bounded polyhedron is called a polytope. 

Every vector d G 1R"\{0} deflnes a family of hyperplanes in R" by Hk^d := {x G ]R"|(x, d) = k}, 

where k £ M.. For any norm || • || on R", every vector x G R" and a > 0, we set Bn ^^\x, a) : = 
{y G R^lllx — y|| < a}. We call this the ball generated by the norm || • || with radius a centered at 
X. By Bn we denote the corresponding closed ball. The Euclidean norm induces a ma- 

trix norm by ||j4|| := max{||^x||2|a; G R" with ||x||2 = 1} = rin{A'^A), where r]n{A'^A) is the 
square root of the largest eigenvalue of the matrix A'^A. It is called the spectral norm of a matrix. 

A special case of Holder's inequality relates the ^2-iiorm to arbitrary ^p- norms: For all x G R", 
we have ||x||2 < ll^^llp ^ n"'"/*'^"^/'^||x||2, if 1 < p < 2, and n^/^~"^/^||2;||2 < II^^Hp < ll^^lb) if 

2 < p < oo. For the ^oo-norm, it holds that n^-'-/^||x||2 < ||a^||oo ^ ll^lb- 

A lattice L is a discrete subgroup of R". Each lattice has a basis, i.e., a sequence bi,. . . ,bm 
of m elements of L that generate L as an abelian group. We denote this by L = C{B), where 
B = [hi, . . . , bm] is the matrix which consists of the columns 6j. We call m the rank of L and n 
the dimension of L. If m = n, the lattice is full-dimensional. The dual lattice L* of L is deflned 
as the set {x G span(L)|(3;, v) £% for all v G L}. If i? is a basis of the full-dimensional lattice L, 
then {B^Y^ is a basis of L* . By Af ^(L) we denote the Euclidean length of a shortest non-zero 
vector in L. 

Since we are interested in computational statements, we always assume that all numbers we are 
dealing with are rationals. The size of a rational number a = p/q with gcd(p, (/) = 1 is deflned 
as the maximum of the numerator and denominator in absolute values, size(a) := max{|p|, \q\}. 
The size of a matrix or respectively a vector is the maximum of the size of its coordinates. If 
we consider a polyhedron P given by a matrix A G (Q*^" and a vector (3 G Q'', then we denote 
by the size of P the maximum of n, s, and the size of the coordinates of A and (3. The size 
of a lattice L C Q"- with respect to a basis B is the maximum of n, m, and the length of the 
numerators and denominators of the coordinates of the basis vectors. By the bit size or the 
representation size of a number a, we mean log2(size(a)). 

3 The lattice membership problem, main result, and reduction 

to Cvp 

Definition 3.1. Given a lattice L C R" and a hounded convex set C C span(L), we call the 
problem to decide whether C contains a vector from L, the lattice membership problem (TmpJ. 

The lattice membership problem is a generalization of the integer programming feasibility prob- 
lem from polyhedra to general bounded convex sets. In Section HI we will show that there exists 



4 



a deterministic polynomial space algorithm, that solves Lmp, if the underlying convex set is an 
£p-ball or a polytope. 

Theorem 3.2. There exists a deterministic polynomial space algorithm that solves the lattice 
membership problem for all convex sets generated by an ip-norm, 1 < p < oo, or a polyhedral 
norm. 

• // the convex set is generated by an ip-norm, 1 < p < oo, the number of arithmetic 
operations is at most plog2{r)'-^^^^n^'^'^''^^^^^ . Each number produced by the algorithm has 
bit size at most p ■ nP^^'f log2(r), where r is an upper bound on the size of the convex set. 

• If the convex set is a full- dimensional polytope given by s constraints, then the number of 
arithmetic operations is at most (s • log2{r))'-^^^^n^'^~^°^^^^"' . Each number produced by the 
algorithm has bit size at most n^^^'^ log2(?'), where r is an upper bound on the size of the 
convex set. 

In the remainder of this section, we show that there exists a polynomial time reduction from 
Cvp to Lmp for all £p-norms and all polyhedral norms. For the reduction, we observe a relation 
between Lmp and the decisional variant of CvP. In the decisional closest vector problem, we 
are given a lattice L C R", some target vector t G span(L) and a parameter a > 0. The goal 
is to decide whether the distance between t and the lattice is at most a or not. Obviously, the 
decisional closest vector problem is a special case of Lmp, where the corresponding convex body 
is the closed ball Bn "^(t, a). Micciancio and Goldwasser showed that CvP and its decisional 
variant are equivalent if one considers CvP with respect to the Euclidean norm, see |MG02j and 
|Mic07| . Their result can be generalized to arbitrary ^p-norms, 1 < p < oo, and to polyhedral 
norms. Since we are interested in algorithmic solutions for this problem, we can always assume 
that L C and t G Z". 

Theorem 3.3. Let \\ • || be a norm on R". Assume that there exists an algorithm A that for 
all lattices C{B') C of rank m and all target vectors t' G span(i?) Pi solves the lattice 
membership problem for the ball Bn "^(t',r) in time Tm.n {S' ,r), where S' is an upper bound on 
the size of the basis B' and the target vector t' . 

• // the norm is an ip-norm, 1 < p < oo, then there exists an algorithm A' , that solves the 
closest lattice vector problem for all lattices C{B) C and target vectors t G span(i?)nZ" 
in time 

k ■ n^(i) log2(S)2 • T{16m^n'^S^, mnS), 
where k = p for I < p < oo and k = 1 for p = oo. 

• // the norm is given by a full-dimensional polytope symmetric about the origin given by 
s constraints, then there exists an algorithm that solves the closest vector problem for all 
lattices C{B) C Z"' and target vector t G span(i?) n in time 

s ■ n^(i) log2(size(P) • S) ■ Tl^^l{16m^n''+^ size(P)"+^ • 5^ nm5size(P)). 

Here, S is an upper bound on the size of the basis B and the target vector t. 

For the proof of this theorem, it does not matter whether the algorithm solves Lmp either for 
the open ball Bn ^^\t,r) or the corresponding closed balls. The proof of this theorem appears 
in the appendix, (see Section [A. 31 in the appendix). 
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Theorem 13. 31 together with Theorem 13.21 imphes a deterministic algorithm that solves the closest 
vector problem with respect to any £p-norm, 1 < p < oo, and any polyhedral norm, e.g. the 
£i-norm and the £oo-iiorm. Furthermore, combining Theorem 13.31 with the inapproximability 
results for CVP from |DKRS03] and |Din02) . we get the following inapproximability result for 
Lmp. 

Theorem 3.4. For all bounded convex sets generated by an ip-norm, 1 < p < oo, there is some 
constant c > such that Lmp is UP -hard to approximate within a factor n^/^°s^ogn ^ 

4 A general algorithm for the lattice membership problem 

In this section, we describe a general framework for algorithms that solve the lattice membership 
problem. Essentially, the algorithm is a variant of Lenstra's algorithm for integer programming 
|Len83| . its improvements by Kannan |Kan87j . and by Frank and Tardos |FT87) . 

Our lattice membership algorithm is a recursive algorithm which works for classes of bounded 
convex sets, which are closed under bijective affine transformation and under intersection with 
hyperplanes orthogonal to the unit vectors. In the following, we consider such a class /C and call 
it suitable. 

Since /C is closed under bijective affine transformation, it is enough to solve the lattice mem- 
bership problem for instances, where the corresponding lattice is the integer lattice Z". Since 
every vector from a lattice L = C{B) is an integer linear combination of the basis vectors of B, 
any bounded convex set C C span(L) contains a lattice vector from L if and only if the bounded 
convex set B~^C contains an integer vector. 

4.1 The main idea of the lattice membership algorithm 

The main idea of our lattice membership algorithm is to use the concept of branch and bound. 
To decide, whether a given bounded convex set C from the class /C contains an integer vector, we 
consider a family {H^^ jlfcgz of hyperplanes given by a vector d G Z". Obviously, every integer 
vector V G Z", which is contained in C, satisfies (d, v) = k for some integer value k £ Z and k is 
contained in the interval 

inf{(J,x)|x eC} <k< sup{{d,x)\x G C}. (4.1) 

Hence, to decide whether the bounded convex set C contains an integer vector, it is sufficient 
to consider all integer values k, which are contained in the interval (|4.ip and check recursively 
whether the convex sets C D Hj^ ^ contain an integer vector. 

In the following, we will call an algorithm which realizes this idea a lattice membership algorithm. 
Furthermore, we will assume the following for the class /C. 

Assumption 4.1. Let K, be a class of full- dimensional bounded convex sets and f -.¥1 ^ 1R>° 
be a nondecreasing function. We assume that there exists a deterministic algorithm A/cj that 
on input a convex set C ^ K. of dimension n outputs one of the following: 

• Either it outputs that C contains an integer vector or 

• it outputs a vector d G and an interval Iq of length at most f{n) such that C contains 
an integer vector if and only if there exists k G ZCiIc such that C Pi Hj^ j contains an integer 
vector. 
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We call such an algorithm Aicj a flatness algorithm. In Section [71 we will show that for certain 
classes of convex bodies we can realize a flatness algorithm. 

Then using the idea of a membership algorithm, we obtain a recursive algorithm for the lattice 
membership problem, whose recursive instances are given by a full-dimensional bounded convex 
set C and an affine subspace H. We start with H := R". Later, H is given by a set of affine 
hyperplanes H^. d.^ ra + 1 < i < n for some m < n. 

Since the convex set COH is not full-dimensional, we construct a bijective affine mapping which 
maps the convex set CCiH to a convex set in R," n -f^o.ej such that every integer vector 

in C n -ff is mapped to an integer vector in r(C H H). Such a convex set can be identified with 
a full-dimensional convex set in IR"*. Additionally, this transformation is constructed in such a 
way such that it guarantees that CCiH contains an integer vector if and only if the corresponding 
convex set in H 0?=™+! contains an integer vector. Such a transformation is described 
in the following. 

First of all, we use an integer vector v & H to map the affine subspace H to the subspace H — v 
which is given as the intersection of the affine hyperplanes Ho^^i, m + 1 < i < n. Since the 
normal vectors di of this subspace are linearly independent, they can be extended to a basis 
of the whole space R", B = [bi, . . . , bm, dm+i, ■ ■ ■ , dn]- Obviously, every vector x £ {H — v) 
satisfies B^x = (x^,0"~™)"^, where x € R™". That means, the function x i— >• B^x maps the 
subspace {H — v) = HILm+i ^o,di subspace niLm+i ^o,ei- To guarantee that we obtain 

a bijection between the integer vectors in H — v and P|"^^_|_^ -f^o,e,;i we construct a basis of the 
lattice C{B^) n fliLm+i ^o,ei ^^"^ rnap every vector in this lattice to its corresponding integer 
coefficient vector. 

Claim 4.2. Let C C R" be a full- dimensional bounded convex set. For m £ ¥1, m < n, let 
H := nr=m+i ^kiAi ^''^ (^ffi''^^ subspace given by di G linearly independent and ki G Z. 
Let V £ Z D H and B = [bi, . . . , bm, dm+i, ■ ■ ■ , dn] G Z"^" be a basis of R" which contains the 
vectors di, m + 1 < i < n. Let D G Z"^™' be a basis of the lattice C{B'^) n nr=m+i ^o,ei '^''^'^ 

Then, the bijective affine transformation 

r : R" ^ R", x^ b-^B^{x - v) 
satisfies the following properties: 

• The transformation t is a bijective transformation between the affine subspace H and the 

subspace f]7=m+l Ho,e,, t{H) = nr=m+l -^0,e, ■ 

• The transformation t is a bijective mapping between n and n P|"^^^]^ -f^o.ei • 

The transformation r can be constructed efficiently: Using the Hermite normal form, we can 
decide in polynomial time, if there exists an integer vector in the affine subspace H and, if so, 
compute one, see Theorem 1.4.21 in [GLS93]- The basis D of the lattice C{B^) n flLm+i ^o,ei 
can be constructed efficiently using a polynomial algorithm from Micciancio, see |Mic08] . 

Proof. Obviously, the transformation r is well-defined. 

We start with the proof of the ffist statement. By definition of r, for all x G R"" and m+1 <i<n 
we have that 

(r(x), e,) = {b-^B^{x - v),ei) = {B^{x - v), {D^y^e,). (4.2) 
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Since the columns of D are vectors in H^nPl?— r^^i ^^o e i we have D'^Ci = for all m+ 1 < i <n. 
Furthermore, Z)^ej = for all m + 1 < i < n. Combining this with (|4.2p . it follows that 

{T{x),ei) = {B'^{x - v),ei) = {x - v, B ■ ei) = {x - v,di). 

Since v £ H = fyj^^^^ ^kj,dj , we have (t(x), e^) = {x, di) — {v, dj) = for all m + 1 < i < n and 
X £ H. This shows that t(x) G 0^=™+! ^o,ej- Since r is bijective and the (affine) subspaces H 
and fXj^^_^^ ^o,ej have the same dimension, it follows that t{H) = Hq^^.. This proves 

the first statement. 

We show the second statement in two steps. First, we show that r maps every integer vector in H 
to an integer vector in lR"nP|"^^_|_j^ ^0,6^- Furthermore, we show that the inverse transformation 

maps every integer vector in IR"" n P|^^_,_]^ Hq^s- to an integer vector in H. 
For every integer vector x G Z*^, we have x — v G and B'^{x — f ) G C{B'^). As both x and v 
are contained in H, it follows that 

{B'^{x — v),ei) = {x — V, Bci) = {x — V, di) = 

for all m + 1 < i < n. This shows that B^{x — v) is a vector in the lattice C{B'^) nfy^^^^^ Ho,ej- 
Since D G Z"^™" is a basis of this lattice, there exists an integer vector z G Z™" such that 
Dz = B^{x - v). Obviously, the vector z' = (z^, 0"""^)^ G satisfies Dz' = B'^{x - v). From 
this, it follows that D^^B'^{x - z) € IT" . 

The inverse of the bijective affine transformation r is given by 

T-^ : R" ^ R", {B^Y^Dy + v. 

To show that T~^{y) G for all integer vectors y G n nj=m+i -^o.e^ > it is enough to 
show that {B'^Y^Dy G Z". Every integer vector y' G Pi nj'=m+i -^0,6^ is of the form y' = 
{y'^ , 0^~"^)'^ with y G Z™. Obviously, we have Dy' = Dy. Since Z) is a basis of the lattice 
£(B^) n n"=m+i ^^o,e, , it follows that 

n 

Dyei:iB^)n fl Ho,e,QC{B^)- 

j=m+l 

Hence, there exists an integer vector w G such that Dy = B^w. □ 

With this transformation r, we are able to identify the bounded convex set C D H with a full- 
dimensional bounded convex set in IR"*. Since /C is closed under bijective affine transformation 
and intersection with hyperplanes orthogonal to the unit vectors, we have t(C H H) G /C and 
we can apply the flatness algorithm Aicj with input t{C H). If the algorithm outputs that 
T{CnH) contains an integer vector, we output that CCiH contains an integer vector. Otherwise, 
we obtain a vector d G and an interval Ir{cnH) of length at most /(m) such that we need 
to search only in the hyperplane -ff^ ^, /c G Z H lT{cnH) ■ Iii this case the recursive instances 
of our membership algorithm are given by the bounded convex set C and the affine subspace 
H n T~^{Hj^ j). For a complete description of the algorithm, see Algorithm [TJ 

Theorem 4.3. Let fC he a suitable class of bounded convex sets satisfying Assumption \4.1\ Given 
a full-dimensional convex set C G /C and an affine subspace H of dimension m, the membership 
algorithm, Algorithmic decides correctly whether CD H contains an integer vector. The number 
of recursive calls of the algorithm is at most (2/(m))™'. 
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Algorithm 1. Membership algorithm for bounded convex sets 
Input: 

• A full-dimensional bounded convex set C from a suitable class /C. 

• An affine subspace H fXi=m+i ^ki.di , where di € linearly independent and 
ki & 7L for all m + 1 < i < n; alternatively, H := R" . 

Used Subroutine: Flatness algorithm Aic.f satisfying Assumption 14 . II . 

If m — Q, check if there exists z ^ "Z^^ H H satisfying z g C 
Otherwise, 

1 . If m = n, set v :— and V :— In ■ 

Otherwise, compute veZ^ni?^ a basis B := d„] € Z"^" of R" . 

Compute a lattice basis Del"''"' of £(5^) n nr=,„+i ^^o,e, • 

Set D := [D, e^+i, . . . , e„] G and t/ D-^B'^ . 
Define the bijective mapping r : R" — > R" , x i— >■ t^(a; — w) . 

2. Apply the algorithm y^AC,/ with input t{C H H) . 

If the algorithm outputs that t{C H H) contains an integer vector, output this. 
Otherwise, the result is a vector d G together with an interval Ir{cnH) ■ 

(a) Set d„ := ^^(J'^, 0""")^ € . 

(b) For all k elD Ir(cnH) , 

apply the membership algorithm to the convex set C sind the 
affine subspace Hr\Hi.^(^i, j^^_^^yj_^_^. 

The algorithm outputs whether the convex set C H H D 
contains an integer vector or not . 

(c) If there exists an index k such that C (1 H D -fffc+(t),d„),d™ contains an 
integer vector, output that C C] H contains an integer vector. 
Otherwise, output that CHH does not contain an integer vector. 



Given as input a full-dimensional bounded convex set C C IR"- and as subspace the whole vector 
space R", the algorithm solves the lattice membership problem correctly. 

Proof. Obviously, if m = 0, the affine subspace H consists of a single vector. Hence, the algo- 
rithm can decide correctly, whether this vector is an integer vector which is contained in C. 
For m > 1, the membership algorithm computes the bijective affine mapping r as described in 
Claim 1^?^ and applies the algorithm A/cj to the full-dimensional bounded convex set T{Cr]H) C 
R™. Depending on the output, the algorithm distinguishes between two cases: 

If the algorithm outputs that T{Cr]H) contains an integer vector, it follows directly from Claim 
14.21 that C D H contains an integer vector. 

Otherwise, the algorithm works recursively and checks for each k € 1i Ci lT{cnH)j whether the 
convex set C Ci H D -fffc+(?),cZm),dm contains an integer vector. We have seen in Claim 14.21 that 
C nH contains an integer vector if and only if t(C H H) contains an integer vector, i.e., a vector 

from z"nnr=^+i^o,e,. 

If we interpret r(C Pi H) as a full-dimensional convex set in R™, it is guaranteed by Assump- 
tion |3?T] that that r(C DH) contains an integer vector if and only if there exists an integer value 
k G Zn/T-(cn//) such that T(Cr]H)r]Hi^ g contains an integer vector. Obviously, this is equivalent 
to the statement that T{Cr\H)r\H^ gn-m^T contains an integer vector from Z"nP|"^,^^;^ Hq ^-, 
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if we interpret t(C H H) as a convex set in R 0?=™+! ^o,ei- Since r is a bijective affine trans- 
formation which maps an integer vector in C Pi -ff to an integer vector in t(C D H), this is 
equivalent to the statement that C (1 H Ci T~^{Hf^ q"-™)^) contains an integer vector. Since 
T^^{Hj^ 0"-™)^) ~ Hk+{v,dm.),dm-' follows that C n H contains an integer vector if and only 
if there exists an index k G Zn/^(cn_ff) such that C D H D Hi^^i^y^fi^^^ ^^i^ contains an integer vector. 

If we are given as input a convex set in R" together with an affine subspace of dimension m, 
we need at most f{m) + 1 solutions of recursive instances, where the dimension of the subspace 
is m — 1, since the length of the interval Ir^cnH) is at most f{m). Hence, the overall number of 
recursive calls is at most 

m 

n(/w + i)<2'"/(mr. 

1=1 

□ 

Obviously, our lattice membership algorithm runs in polynomial space if the bit size of each 
number computed by the algorithm is polynomial in the bit size of the input instance. Similarly 
to the algorithms by Lenstra and Kannan, this cannot be guaranteed for the outline of our 
lattice membership algorithm presented so far. In fact, the size of the newly constructed affine 
hyperplane depends not only on the size of the convex set C but also on the size of the affine 
subspace. To avoid this problem, we use a replacement procedure due to Frank and Tardos, see 
[FT87] ■ which we describe in the following section. 

4.2 Modification of the Lattice Membership Algorithm 

The replacement procedure from Frank and Tardos presented in |FT87| is a polynomial algorithm 
that on input an affine subspace H C R" and an additional hyperplane Hk^d computes a set 
of new hyperplanes ifg. j. , i G J, with small size. If the parameters are chosen appropriate 
depending on the shape of the convex set, then it can be guaranteed that each integer vector in 
the convex set is contained in the affine subspace H Pi Hi^ cl if and only if it is contained in the 
intersection H Ci HieJ di- following result is a slightly generalization of Lemma 5.1 in 

|FT87| . The proof of it together with a short description of the procedure appears in the full 
version of this paper. 

Proposition 4.4. There exists a replacement procedure, which satisfies the following properties: 
Given as input a parameter N £ ¥1, an affine subspace H and an additional affine hyperplane 
Hk,d the replacement procedure computes a set of hyperplanes H^. j., z G J 7^ 0, such that the 

following holds: Every integer vector z G S^^^(0, N — satisfies {d, z) = k if and only if it 

satisfies {di, z) = ki for all i €z J. 

The size of the vectors di G and the numbers ki G Z is at most 2*^""^^^ N"". The number of 
arithmetic operations of the replacement procedure is at most (n • log2(A^))'^*-^'' . 

We will use this replacement procedure in the lattice membership algorithm directly before the 
recursive call of the algorithm with a suitable computed parameter N. This guarantees that 
we obtain additional hyperplanes whose size depend only on the size of the convex set C, or to 
be precise on the parameter A'^ defining the radius of a circumscribed ^i-ball, and not on the 
size of the affine subspace H. We call this algorithm the modified membership algorithm. For 
completeness, a formal description of this algorithm appears in Algorithmic 

Theorem 4.5. Let fC be a suitable class of bounded convex sets satisfying Assumption \4. 1\ 
Given a full- dimensional bounded convex set C C from the class /C and an affine subspace H, 
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Algorithm 2. Modified membership algorithm for bounded convex sets 
Input: 

• A full-dimensional bounded convex set C from a suitable class K. and 

• an affine subspace H :~ HiLm+i -^'^i '^i > where di € linearly independent and 
ki & 7L for all m + 1 < i < n; alternatively, H := R" . 

Used Subroutine: Flatness algorithm Aicj satisfying Assumption 14 . II . replacement 
procedure . 

If m = 0, check if there exists z G n satisfying zgC 
Otherwise, 

1 . If m = n, set v := and V :— In ■ 

Otherwise, compute veTT-fMI, a basis B := d„] e Z"^" of R" . 

Compute a lattice basis £» G Z"^" of £(5^) n nr=m+i ^^o.e, • 

Set Z) [D, e^+i, . . . , e„] G and V D-^B'^ . 
Define the bijective mapping r : R" R" , x i— > — u) . 

2. Apply the algorithm A)c.f with input t{C C] H) . 

If the algorithm outputs that t{C H H) contains an integer vector, output this. 
Otherwise, the result is a vector d G Z'" together with an interval IricnH) • 

(a) Set d„ := 0"^")^ G Z" . 

Compute a parameter G N such that C C i3i^''(0, A^- 1). 

(b) For all A: G Z H Ir(cnH) , 

• apply the replacement procedure to the affine subspace H , the 
hyperplane given by d^ and k + (w, dm) and the parsimeter iV . 

The result is an index set Jk and an affine subspace {^i^j^ Hj.. . 

• Apply the modified membership algorithm the convex set C and the 
affine subspace H n fljej,, ^^fc,,d, • 

As a result, we get the information ±f C H H D Cli^ji^H^.^. contains 
Ein integer vector or not . 

(c) If there exists an index k such that C H H D Hiej^. Hj,. contains an 
integer vector, output that CHH contains an integer vector. 
Otherwise, output that CHH does not contain an integer vector. 



the modified lattice membership algorithm, Algorithmic decides correctly whether C D H contains 
an integer vector or not. Each recursive instance consists of the original convex set C and an 
affine subspace of size at most max{size(if), 2^"'^^^^ A^"}, where C C Bn\o,N — 1). 

Proof. Since C C Bn\o,N — 1), for all G Z, the convex set C contains an integer vector 
from H n -fffc+(D,(im>,rfm' ^^'^ only if it contains an integer vector from H D flig/j. dii (^^^ 
Proposition 14. 4p . Hence, the correctness of the algorithm follows directly Theorem 14.31 Also, 
the upper bound on the size of the recursive instances follows directly from Proposition 14.41 □ 

Obviously, we are able to adapt this general framework for all classes of bounded convex sets for 
which there exists a flatness algorithm. For polytopes and ^p-balls we will see that we are able 
to do this using so called Lowner-John ellipsoids. 
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5 A lattice membership algorithm for polytopes 



In this section, we consider full-dimensional polytopes given by a matrix A £ g'^^" and a vector 
/3 € Z*. Obviously, the class of all full-dimensional polytopes is closed under intersection with 
hyperplanes and under bijective affine transformation. Furthermore, in Section [7. 2 1 we will show 
that there exists a flatness algorithm for polytopes. 

Theorem 5.1. There exists a flatness algorithm that for all full- dimensional polytopes P C IR" 
outputs one of the following: Either it outputs that P contains an integer vector or it outputs a 
vector (i G and an interval Ip of length at most 2r? such that P contains an integer vector 
if and only if there exists k £TLV\lp such that P n j contains an integer vector. 
The number of arithmetic operations of the flatness algorithm is 

log2(r)n"/(2e)+o(n) 

and each number computed by the algorithm has size at most r"'''^', where r is an upper bound 
on the size of the polytope and s is the number of constraints defining the polytope. 

Using this result, we can adapt the algorithmic framework from Section |4l to solve the lattice 
membership problem for polytopes and we obtain a lattice membership algorithm for polytopes. 
To compute the parameter A^, which defines a circumscribed £i-ball of the polytope, we use 
that the vertices of every full-dimensional polytope given by integral constraints are at most 
72("+i)/2 size(P)'^ (in absolute value). Hence, we set as r^"'+3)/'^r"', where r is an upper bound 
on the size of the polytope. A detailed description of the algorithm is given in Algorithm |3l 

Theorem 5.2. Let P C IR,*^ be a full-dimensional polytope given by a matrix A £ 2«x" and a 
vector /3 £ W. Let H C IR," be an affine subspace of dimension m < n. 

Given as input P and H , the lattice membership algorithm for polytopes, Algorithm O decides 
correctly whether P D H contains an integer vector. The number of arithmetic operations of the 
algorithm is 

(n-slog2(r))^Wm(2+°W)-, 

where r is an upper bound on the size of the polytope P and the affine subspace H. The algorithm 
runs in polynomial space and each number computed by the algorithm has size at most r"'^^^\ 
that means bit size at most n'^^^^ log2(r). 

Proof. Since P is a polytope with size at most r, it is contained in the ball ^^°°''(0,t) with 
t = fi{n+i)/2^n^ Lemma I A. 161 in the Appendix. Hence, P C Bn\o,n'^/'^~^^r"') and the pa- 
rameter A^ computed by the algorithm satisfies P C Bn\o,N — 1). 

The transformation r : x i— t- V{x — v) maps the intersection P D H to the polytope {x S 
IR^IAt/"^^; < /3 — } n Ho^e- which can be identified with the full-dimensional polytope 
P = {x £ W^\Ax < /3 — Av}, where A G g'^x™ consists of the first m columns of the matrix 
AV~^. Hence, the correctness of the algorithm follows from Theorem 14.51 

The lattice membership algorithm for polytopes gets as input a polytope P C IR" and an 
affine subspace H of size of at most r. It is easy to see that each number computed by the 
algorithm in one reduction step has size at most r"'^*^' . The recursive instances of the lattice 
membership algorithm consist of the original input polytope P and a new affine subspace. 
The new affine subspace is the intersection of the original subspace H and another subspace 
H]^_ Therefore, we denote the size of the polytope P separately by rp. Obviously, 
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Algorithm 3. Lattice membership algorithm for polytopes 
Input: 

• A full-dimensional polytope P given by A G Z^^" and j3 ^ W with size rp and 

• an affine subspace H :— HiLm+i -^feii^i given by di G linearly independent and 
ki&TL, m + l<i<n; alternatively, H . 

Used Subroutines: flatness algorithm for polytopes, replacement procedure. 

If m — Q , check if there exists z ^ "Z^^ H H satisfying z € P. 
Otherwise, 

1 . If m = n, set v :— and V :— In ■ 

Otherwise, compute vGZ^ni?^ a basis B := d„] G Z"""" of R" . 

Compute a lattice basis £» G Z"^" of £(5^) n nr=,„+i ^^o,e, • 
Set D [D, e^+i, . . . , e„] G and V := i)-^B'^ . 

2. Apply the flatness algorithm for polytopes to the polytope P given by 

A G S*^™ and (3 — Av G Tf , where A is the matrix which consists of the first m 
columns of the matrix AV~'^ . 

If the algorithm outputs that P contains ajo. integer vector, output that P H H 
contains sin integer vector. 

Otherwise, the result is a vector d G together with an interval Ip . 

(a) Set := S(Z)'^)-i(J^,0"-"')^ G and iV := n("+3)/2r^ + 1 . 

(b) For all keZnlp, 

• apply the replacement procedure to the affine subspace H, the 
hyperplcine given by dm snd k+{v,d„i) and the parameter N. 

The result is an index set Jk and an affine subspace Hiej;. ^fc; J; • 

• Apply the modified membership algorithm to the polytope P and the 
affine subspace H n fl.ej, -fffc,,J, • 

As a result, we get the information if P H H D Cli^ji^ H^. contains 
an integer vector or not . 

(c) If there exists an index k such that P H H D Hiej^ di contains an 
integer vector, output that P C] H contains an integer vector. 
Otherwise, output that P H H does not contain an integer vector. 



r >rp. According to Theorem 14. 5 [ the size of the affine subspace used for the recursive calls of 
the algorithm is at most 

max{size[n ) , r p | = max|r,rp |. 

Especially, the replacement procedure guarantees that the size of the additional hyperplanes 
H^, j^., « G Jki depends only on the size of the polytope rp. Hence, it follows that 

maxjrp , rj = r 

is an upper bound on the size of each number computed by the lattice membership algorithm. 

Finally, we give an upper bound on T{m,n, s,rp,r), the number of arithmetic operations 
of the lattice membership algorithm. Obviously, T{0,n, s,rp, r) = (s • n)^(i). Given a full- 
dimensional polytope in IR"' together with an affine subspace of dimension m > 0, the com- 
putation of the affine bijective transformation r can be done using at most n'-^^^^ arithmetic 
operations. The number of arithmetic operations of the flatness algorithm depends on the size 
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of the input polytope P. Hence, the number of arithmetic operations of the flatness algorithm 
is at most 

(s-n)^« log2(r)m'"/(2e)+oM^ 

as stated in Theorem 15.11 The number of arithmetic operations of the replacement procedure 
is polynomial in n and log2(A^). By our definition of N , we have log2(A^) < {"n? + 1) log2(2mr). 
This shows that the number of arithmetic operations of the replacement procedure is at most 
(n • \og2{rp))'~^^^\ see Proposition 14.41 The number of recursive calls of the lattice membership 
algorithm is determined by the length of the interval computed by the flatness algorithm. The 
length of this interval is at most 2m? ^ see Theorem 14. 31 Hence, we obtain the following recursion 
of the number of arithmetic operations 

r(m, n, s, rp,r)< {ns log2(r))^(i)m'"/(2e)+o(m) ^ ^2m^ + 1) • T{m -l,n,s, rp, max{r, r^°*" }). 

Here, the main observation is that the size of the polytope does not change, whereas the size of 
the new subspace is the maximum of the size of the original input subspace and rp*^^^' . Hence, 
it follows by induction, that for all m > 0, 

T{m,n,s,rp,r) < (ns log2(r))^W . ^(2+o(i))m^ 

□ 

If we choose as subspace H = R", we obtain an algorithm for the lattice membership problem. 

Corollary 5.3. The lattice membership algorithm for polytopes, Algorithmic^ solves Lmp for 
all full-dimensional polytopes given by a matrix A £ g'^x" and a vector 13 £ W correctly. The 
number of arithmetic operations of the algorithm is at most s'^(i) log2(r)'-^(^)n(^+°(^))"'. The 
algorithm runs in polynomial space and each number produced by the algorithm has bit size at 
most n'^(^) log2(r). 



6 A lattice membership algorithm for ^^-balls, 1 < j9 < oo 

Next, we use the algorithm framework presented in Section |4] to obtain an algorithm that solves 
Lmp for ^p-balls with 1 < p < oo. Since the set of all £p-balls is not closed under bijective affine 
transformation, we consider in the following a generalization of them. We consider norms, whose 
unit balls are the linear map of the ip-unit ball. 

Definition 6.1. Let V € R"^" be nonsingular. For a vector x G R", we define 

Obviously, the mapping || • ||^ defines a norm on R". We denote the balls generated by such a 
norm by Bi!''^\t, a), i. e., for t € R" and a > we define 

B^P'^\t,a) :={xG R"|||x-t||^ <a}. 

If the matrix V is an orthogonal matrix, the unit ball of this norm is just the rotation of the 
^p-unit ball by the matrix V. If we consider the standard ^p-norm, we omit the matrix /„ and 
write bI^^ {t, a) instead. 
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To use these convex sets in the lattice membership algorithm, we need to consider their inter- 
section with hyperplanes orthogonal to the unit vectors. To be precise, for m G N, m < n, we 
define 

n 

i=m+l 

We will call these convex sets ip-bodies^ . In the following if we speak of an £p-body, we assume 
that we are given a nonsingular matrix V G R"^", a vector t G R", parameter m G N, m < n, 
and a > and we consider the convex set B^P')^\t,a). The size of such an £p-body is the 
maximum of m, n, a and the size of the coordinates of and t. 

Formally, the ^p-body Bm^n^ [t, a) is a m-dimensional bounded convex set in the subspace 
span(ei, . . . ,em) of the vector space IR". But in the following, we will neglect this and we will 
interpret Bm,n\t, a) as a full-dimensional bounded convex set in the vector space R'". Then, we 
say that a vector x G R™ is contained in Bmln\t,ct) if and only if (x"^, 0""*")"^ G Bl^'^\t,a). 
In Section [7.31 we will show that for all £p-bodies, there exists a flatness algorithm. 

Theorem 6.2. (Flatness algorithm for £p-bodies) There exists an algorithm that for all Ip-bodies 
Bmln\t,C() outputs One of the following. ■ 

• Either it outputs that Bm^n^ (t, a) does not contain an integer vector, or 

• it outputs that Bmln\t,a) contains an integer vector, or 

• it outputs a vector d G Z"* and an interval of length at most Am? such that Bm%\t, a) 
contains an integer vector if and only if there exists k G Z H such that Bm^n^ (t , a) Pi Hf, j 
contains an integer vector. 

The number of arithmetic operations of the algorithm is 

(nlog2(r))'^(i)m"^/(2e)+o{m) 

The algorithm runs in polynomial space and each number computed by the algorithm has size at 
most rP^'^^^\ where r is an upper bound on the size of the ip-body. 

Using this algorithm and combining it with the ideas and methods presented in Section HI we 
are able to show that there exists an algorithm that solves the lattice membership problem for 
the class of ^p-bodies with 1 < p < oo. Especially, we obtain an algorithm that solves the lattice 
membership problem for balls generated by an ^p-norm. 

Substantially, the algorithm works in the same way as the general algorithmic framework pre- 
sented in Section |4l The algorithm gets as input a full-dimensional ip-hody Bn'^^ [t, a) and an 
affine subspace. During the algorithm, we have to take into account that it is possible, that the 
flatness algorithm outputs that the ^p-body does not contain an integer vector. For the com- 
putation of the parameter N, which defines a circumscribed £i-ball of the £p-body, we use the 
following result, which computes for a given -^p-body a circumscribed Euclidean ball. The idea of 
this construction is that for a given ^p-body Bm',n\t,C(), we use Holder's inequality to construct 
an ellipsoid, which contains B^'^\t, a). This ellipsoid is contained in an Euclidean ball whose 
radius is the largest eigenvalue of V. Then, we intersect all with the subspace f^^^,^_^^ ^Q^g-. 

^Obviously, ^p-bodies are not convex bodies but bounded convex sets. 



15 



Lemma 6.3. Let Bm',n\t,a) be an ip-body given by V ^ Q"^" nonsingular, t G Q", a > 
and 1 < p < Qo. Then Bm'^\t,a) is contained in an m- dimensional Euclidean ball with radius 
a^/n\\V\\. The center of this ball is given by the orthogonal projection oft onto spajn(6i, • • • 5 ^m)' 

Proof. Using Holder's inequality, we obtain that the ^p-body Bn'^\t,a) is contained in the set 
{x E lR,'^|||y-i(x-t)||2 < ay/n], which is the open ellipsoid ay/n-kEiVV'^ ,t). The circumscribed 
radius of an ellipsoid is given by the square root of the largest eigenvalue of the matrix defining 
it. The square root of the largest eigenvalue of VV'^ is the spectral norm of the matrix V. 
Hence, we obtain that 

4^''^)(t,a)Ci?(2)(t,aV^||F||). 

Obviously, it follows that the £p-body B^'J? {t, a) is contained in the intersection of the Euclidean 

(2) 

ball (i, a-\/n||l^||) with the hyperspace n[L^_,_]^-ffo,ei) which is an m-dimensional ball with 
radius at most a-y/n||y||. The center of this ball is given by the orthogonal projection of t onto 
span(ei,...,em). □ 

Using this result, we can define the parameter as 2nr||y|| + 1, where \\V\\ denotes the spectral 
norm of the matrix V. A detailed description of the algorithm is given in Algorithm |4] 

Theorem 6.4. Let Bn'^\t, a) be an Ip-body given byVG Q"^" nonsingular, t E Q"', a > and 
1 < p < 00 and let H be an affine subspace of dimension m < n. Given as input Bn''^\t, a) and 
H, the membership algorithm for Ip-bodies, Algorithm^ decides correctly whether Bn'^\t, a) (1 
H contains an integer vector. The number of arithmetic operations of the algorithm is at most 
p(ralog2(r'))^^^^m'-^^°^^^''™, where r is an upper bound on the size of Bn'^\t,Q) and the affine 
subspace H . The algorithm runs in polynomial space and each number computed by the algorithm 
has size at most rP'"''^^^\ that means bit size at most pn'^^^^ log2(?^)- 

Proof. We have seen in Lemma [6.3l that Bn'^\t, a) is contained in an Euclidean ball with radius 
a-^/n||y||. Hence, 

i?(P'^)(t,a) C B'it\t,an\\V\\) C S«(0,nr(l + ||y||). 

By definition of N this shows that Bn'^\t,a) C Bn\o,N — 1). Since the transformation 
r : X I— )• V{x — v) maps Bn\t, a)r\H to the ^p-body Bm,n^\v{t — v), a), it follows from Theo- 
rem |4]5] that the membership algorithm for £p-bodies decides correctly whether Bn''^\t, a) H H 
contains an integer vector. 

It is obvious, that each number computed by the lattice membership algorithm in one reduction 
step has size at most r*^*^^^' . The recursive instances of the lattice membership algorithm consist 
of the original ^p-body bI^'^^ {t, a) and a new subspace. Therefore, we denote the size of the 
^p-body Bn''^\t,a) separately by rg. Obviously r > rg. 

According to Lemma 14. 5[ the size of the affine subspaces used for the recursive calls of the algo- 
rithm is at most maxlrj^''*^' , r}. Especially, the replacement procedure guarantees that the size 
of these subspaces depend only on the size of the £p-body vq and not on the size of the affine 
subspace IL. Hence, it follows that maxlr^*^'^' , r}"°'^' = r"°'^' is an upper bound on the size 
of each number computed by the lattice membership algorithm. 



Now we give an upper bound on the number of arithmetic operations of the algorithm, denoted 
by T{m,n,p,r;3,r). For m = 0, we obtain that T(0,n,p,rQ,r) = n^^"*^^. For m > 1, the 
algorithm constructs the bijective affine transformation according to the construction described 
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Algorithm 4. Lattice membership algorithm for £p-bodies 
Input: 

• An £p-body si^'^' (i, a) given by a nonsingular matrix V G Q"^", a vector t G Q" 
ctnd a parameter a > with size Eind 

• an affine subspace H :~ HiLm+i -^fei^^i given by di G linearly independent and 
ki€TL, m + l<i<n; alternatively, iJ:=]R". 

Used Subroutines: Flatness algorithm for ^p-bodies, replacement procedure. 

If m = 0, check if there exists z G n satisfying z G B'^\t,Q.) . 
Otherwise, 

1 . If TO = 71 , set w := and V := /„ . 

Otherwise, compute v&'E^f^H,_ a basis B := . . . , . . . , d„] G Z"""" of R". 

Compute a lattice basis £» G Z"""" of /^(B^) H nr=m+i ^fo,e, • 
Set b := [D, e,„+i, . . . , e„] G and := D-^B^ . 

2. Apply the flatness algorithm with Bm'X^\v {t — v) , a) . 

If it outputs that Bm',n^\v{t — does not contain an integer vector, then 

output that B^'^\t,a) f] H does not contain an integer vector. 

If it outputs that Bmln^\v{t — contains an integer vector, then output 

that Bn''^\t,a) H contains an integer vector. 
Otherwise, the result is a vector d G together with sin interval /g . 

(a) Set rf„ y^(J^,0"-™)^ G and N := 2nrB\\V\\ + I . 

(b) For all fc G Z n /g , 

• apply the replacement procedure to the affine subspace H , the 
hyperplcine given by d„i and k+{v,d„i) and the parameter N. 

The result is an index set Jfe and an affine subspace PlieJt. di ■ 

• Apply the membership algorithm to the £p-body Bn''^\t,a) and the 
affine subspace H n PlieJt. ^fc; di • 

As a result, we get the information if Bl^'^\t,a) Ci H (1 Cli^j^H^..^. 
contains an integer vector or not . 

(c) If there exists an index k such that _Bi'''^^(t, a)ni?nP|jgj^ iJj.. j. contains 

an integer vector, output this. Otherwise, output that B^'n''^^ (t^a) C\ H 
does not contain an integer vector. 



in Claim 14.21 This needs at most n^^^^ arithmetic operations. According to Theorem 16. 2| the 
number of arithmetic operations of the flatness algorithm Ab is at most 

p-{n- log2(size(B^;^^)(F(t - T;), a))))^(^)m"^/(2e)+o(m) < . ^^^^^^y^O(l)^m/{2e)+oim) _ 

The number of arithmetic operations of the replacement procedure is polynomial in the dimen- 
sion n and log2(A'^). Since N is at most 4nr||l/||2 < r"*^'^' this is at most n'-'(^Hog2(r)'^(^). 
The number of recursive calls of the algorithm is determined by the length of the interval Iq, 
which is at most 4m^, see Theorem 16.21 This shows that for m > 1, the number of arith- 
metic operations of the lattice membership algorithm can be upper bounded using the following 
recursion, 

T{m, n, p, re, r)<p-{n log2(r))^(^)m™/(2e)+o(m) ^ ^^^2 ^ -^^ . _ ^^^^ max{r, rg"'" }). 
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As in the case of polytopes, we observe that the size of the new subspace is the maximum of the 
size of the input subspace and rg'''^', whereas the size of the £p-body does not change. Hence, 
it follows by induction, that for all m > 0: 

T{m,n,p,rB,r) < p(nlog2(r))^(i)m(2+°(i))"^. 

□ 

If we apply the lattice membership algorithm with input an £p-body and as subspace the whole 
vector space, we obtain an algorithm for the lattice membership problem. 

Corollary 6.5. The membership algorithm for ip-bodies, Algorithm^ solves the lattice member- 
ship problem for all Ip-bodies Bn'"^^ [t, a) correctly in polynomial space. The number of arithmetic 
operations of the algorithm is at most plog2{r)''^^^^n^'^~^°^^^^"' , where r is an upper bound on the 
size of the £p-body. Each number computed by the algorithm has size at most rP'"''^^^\ that means 
bit size at most p ■ n'-^^^^ log2(r). 

7 An algorithm for computing a flatness direction 

In this section, we consider constructive versions of so-called flatness theorems. The fundamental 
statement of the flatness theorems is that every bounded convex set C which does not contain 
an integer vector has at least one direction where it is flat. This means that there exists a vector 
d G li"" such that the number of hyperplanes Hj^ ^, k £ which intersect C is bounded. The first 
result in this area was due to Khinchin, |Khi48] . For an overview about the existing variants 
see |Bar02) . 

To formalize the idea how many hyperplanes intersect a bounded convex set, we use the notion 
of the width of a convex set C C IR," along a vector d G 1R,"\{0}, which is defined as the number 

w^{C) := sup{((i, x)\x £ C} — mf{{d, x)\x G C}. 

If C is closed, we have wj(C) = max{(d,x)|x G C} — mm{{d, x)\x G C}. The width of C is defined 
as the minimal value w^{C), where d G Z"\{0}. A vector d, which minimizes w^(C) is called a 
flatness direction of C. 

The flatness theorems guarantee that the width of every convex body, which does not contain 
an integer vector, is bounded by a number which depends only on the dimension. 

In the following, we will show that for certain bounded convex sets, we are able to compute such 
a vector d G Z". First, we show this result for special convex bodies, ellipsoids. Then we will 
generalize this result to polytopes and ^p-bodies. 

7.1 A flatness algorithm for ellipsoids 

Ellipsoids are special convex sets. Formally, a set E C R" is called an ellipsoid, if there exists a 
vector c G R" and a positive definite matrix D G R"^" such that 

E = {x£ R"|(x - cfD-^{x - c) < 1}. 

The vector c is called the center of the ellipsoid and we denote by E{D, c) the ellipsoid given by 
the matrix D and the vector c. The ellipsoid is uniquely determined by the symmetric positive 
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definite matrix D and the center c. 

For every symmetric positive definite matrix D, there exists a decomposition D = ■ Q. Such 
a matrix Q gives us a bijective affine transformation, that maps the Euchdean unit ball to the 
ellipsoid E{D,c). To be precise, a set E C R" is an ellipsoid E = E{D,c) for a symmetric 
positive definite matrix D G R"^" and a vector c G R" if and only if E is the affine image of 
the Euclidean unit ball, i.e., 

i^ = Q^-i?(2)(o,l)+c, 

where D = • Q. Observe that this affine transformation is not uniquely determined, since the 
decomposition of a symmetric positive definite matrix is not unique. Nevertheless, this relation 
between ellipsoids and the Euclidean unit ball is fundamental in the understanding of ellipsoids. 
Nearly every property of an ellipsoid can be deduced from the corresponding property of the 
Euclidean unit ball by applying the bijective transformation Q^. 

For example, we can show that for an ellipsoid E = E{D, c) C MP and a vector d G R"'\{0}, we 
have max{(d,x)|x G E{D,c)} = {d, c) + V (FDd and m.\n{{d,x)\x G E{D,c)} = {d, c) — V dTDd. 
Hence, the width of the ellipsoid along disw ,{E) = iVd^Dd. 

The next proposition characterizes a flatness direction and the width of an ellipsoid. Addi- 
tionally, we are able to show which hyperplanes of a family of hyperplanes have a non-empty 
intersection with an ellipsoid. 

Proposition 7.1. Let E = E{D,c) C R" be an ellipsoid and D = Q^Q be an arbitrary 
decomposition of the matrix D. Then a vector d & is a flatness direction of the ellipsoid if 
and only if Qd is a shortest non-zero vector in the lattice C{Q). That means, we have 

w{E)=w^[E) = 2\f\cm 

and for d = Qd G C{Q) we obtain, 

max{((i, G E} = {d,c) + \\d\\2 and mm{{d,x)\x G E} = {d,c) — \\d\\2- 

We observe, that it follows from this proposition that the width of an ellipsoid can be computed 
using an arbitrary decomposition of the matrix defining the ellipsoid. 

Proof. As we have seen, the width of an ellipsoid along a vector d G Z"\{0} is given by 

w^{E{D, c)) = 2\/ dTDd. Hence, for every decomposition D = Q^Q of the matrix D, we 
have 

Vd^Dd = ^{QdYiQd) = WQdh. (7.3) 

which shows that the width w^{E{D,c)) is is minimized for d G Z'^\{0}, if Qd is a shortest 
non-zero vector in the lattice C{Q) generated by the matrix Q. This proves the ffist statement. 
The proof of the other statements follows directly from (|7.3p . □ 

With this statement, we are able to prove the flatness theorem for ellipsoids using the well-known 
transference bound for lattices proven by Banaszczyk, see |Ban93| . For completeness, the proof 
appears in the appendix, see Section IA.5I 

Theorem 7.2. (Flatness Theorem for EUipsoids) Let E C R" be an ellipsoid. If the width 
of the ellipsoid is at least n, w{E) > n, then the ellipsoid contains an integer vector. 
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Combining Proposition 17. II together with the flatness theorem for elhpsoids we obtain a flatness 
algorithm for elhpsoids: Given an ellipsoid, we compute its width and a corresponding flatness 
direction d G by computing a shortest non-zero lattice vector in the lattice C{Q). If the width 
is larger than n, we output that the ellipsoid contains an integer vector. Otherwise, we output the 
flatness direction d E together with an interval Ie = [min{((i, G E'}, max{((i, € i?}]. 
In this case, the interval Ie satisfles that E contains an integer vector if and only if there exists 
k G Zn/^; such that ECiHj^ j contains an integer vector. To compute a shortest non-zero lattice 
vector in C{Q), we cannot use the single exponential time algorithm by Micciancio and Voulgaris 
|MV10) since it requires exponential space. Instead we use Kannan's polynomial space algorithm 
|Kan87) with its improvement by Hanrot and Stehle |HS07) . For a complete description of the 
algorithm see Algorithm |5l 

Algorithm 5. Flatness Algorithm for Ellipsoids 
Input: Ellipsoid E E{D,c) 

• Compute a decomposition D = Q^Q of the matrix D. 

• Compute a shortest non-zero lattice vector d G >C(Q) using Kannan's algorithm 
for Svp. Let J g~i(i e . 

• Set w := 2||d||2 . 

If w>n, output that E contains an integer vector. 

Otherwise output d E together with fcniin := \{d,c) — \\d\\2] and fc„iax := [{d,c) + 
\\d\\2\. 



Proposition 7.3. Given an ellipsoid E C R", the flatness algorithm for ellipsoids, Algorithm 
[21 outputs one of the following: Either it outputs that E contains an integer vector or it outputs 
a vector d E Z*^ and an interval Ie of length at most n such that E contains an integer vector 
if and only if there exists k S 1i Ci Ie such that E D Hj^ j contains an integer vector. The 
number of arithmetic operations of the algorithm is ri^/('^'^)+°(^) , the algorithm has polynomial 
space complexity, and each number computed by the algorithm has size at most r"'^*^', where r 
is an upper bound on the size of E. 

Proof. The correctness of the algorithm follows directly from Proposition 17.11 and Theorem 17.21 
To see that the size of each number computed by the algorithm is at most r"*^*^', we observe 
that the length of the flatness direction is at most 

\\d\\2 < size(I))('^+l)/2 < „(-+2)/2^(n+l)/2^ 

see Lemma lA.21l in the appendix. 

Hence, the only thing we need to take care of is that the numbers /cmiiu ^max G ^ does not 

(2) 

become too large. By deflnition, they are at most {d,c) + 2\\ {C{Q)). Since the width of the 
ellipsoid E is at most n, we obtain using the Cauchy-Schwarz inequality 

A; < n("+2)/V"+i)/2||c||2 + n < r"°''\ 

The number of arithmetic operations is dominated by the number of arithmetic operations 
needed to compute a shortest non-zero lattice vector in C{Q) using Kannan's SvP-algorithm. 
By the analysis of Hanrot and Stehle |HS07| the number of arithmetic operations can be bounded 
j^n/(2e)+o{n) |;jjj^gg gome factor polynomial in the input size. □ 

In general, we are not able to compute a flatness direction of a bounded convex set. But we 
can approximate the convex set by an ellipsoid and in this way obtain a direction in which the 
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convex set is relatively flat. By the approximation of a bounded convex set with an ellipsoid, 
we understand an ellipsoid which is contained in C. The approximation factor is that factor, 
whereby we need to scale the ellipsoid such that the scaled ellipsoid contains the convex set. By 
scaling an ellipsoid with a positive factor r > we understand the ellipsoid obtained from E by 
scaling it from its center by the factor r. We denote this as r-kE. Formally, ii E = E{D, c), then 
r -k E := r ■ E{D,0) + c. Alternatively, such a scaled ellipsoid can be characterized as follows: 
For r > 0, we have r -k E = E{r'^ ■ D,c). We call an ellipsoid, which approximates a bounded 
convex set an approximate Lowner-John ellipsoid. 

Definition 7.4. Let C C IR*^ be a full- dimensional bounded convex set and < 7 < 1. An 
ellipsoid E satisfying E (^C CI (I/7) -k E is called 1/ ^-approximate Lowner-John ellipsoid of C. 
We call 1/7 the approximation factor of the Lowner-John ellipsoid. 

If we are able to compute approximate Lowner-John ellipsoids for a class of bounded convex sets, 
then there exists a flatness algorithm for this class: Given an approximate Lowner-John ellipsoid 
S of a full-dimensional bounded convex set C, we can compute the width and a corresponding 
flatness direction d G of the ellipsoid. If this width is larger than n, the ellipsoid and 
therefore the convex set C contain an integer vector. Otherwise, we observe that the width of 
the circumscribed ellipsoid (I/7) is at most (I/7) • w{E) < n/'j and that d S is also a 
flatness direction of the circumscribed ellipsoid. Hence, the vector d S satisfies that 



max 



{{d,x)\x £ (1/7) - mm{{d,x)\x £ (1/7)*^;} < n/7. 



Since the convex set C is contained in (l/'y)-kE, the vector d also satisfies that every hyperplane 
J which has a non-empty intersection with C satisfies that min{(d, x) \x G (I/7) * E} < k < 

max{(d, x)\x G (I/7) * E}. 

Now, we use this idea to obtain flatness algorithms for polytopes and ^p-bodies. In what follows, 
we show that for these convex sets there exist polynomial-time algorithms that compute approx- 
imate Lowner-John ellipsoids. The algorithms are modifications of the famous ellipsoid method 
from Shor and Khachiyan and are based on an idea due to Yudin and Nemirovskii and Goffin 
see |Sho77) . |Kha79) . |YN76) and |Gof84| . In general, these algorithms are known as shallow cut 
ellipsoid methods. For more information about the ellipsoid method and its modifications see 
|GLS93| . |Lov86| . |Sch86| or |KV02] . 

7.2 A flatness algorithm for polytopes 

For polytopes, there exists a polynomial algorithm that computes an approximate Lowner-John 
ellipsoid. The following result is due to [SchSGj. 

Theorem 7.5. There exists an algorithm that given a full- dimensional poly tope P C com- 
putes a 2n- approximate Lowner-John ellipsoid for P in time polynomially bounded by n and the 
size of P. 

For us, this result is not enough. We need more precise statements about the running time and 
the size of the ellipsoid, as stated in the following. A complete description of the algorithm 
together with a proof of the following theorem appears in the full version of this paper. 

Theorem 7.6. (Rounding method for polytopes) There exists an algorithm that given a full- 
dimensional polytope P C IR," computes a 2n-approximate Lowner-John ellipsoid given by a 
symmetric positive definite matrix D £ Q"^" and a vector c G Q"'. The number of arithmetic 
operations is (ns)'^''^-' log2(7'), where s is the number of constraints defining the polytope and r is 
an upper bound on its size. Each number computed by the algorithm has size at most ^P^^ 
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Using this algorithm, we can adapt the idea described above and we obtain a flatness algorithm 
for polytopes. A complete description of the algorithm is given in Algorithm [G] 



Algorithm 6. Flatness Algorithm for Polytopes 

Input: A full-dimensional polytope PC R" given by A G W^"^ and /? G 
Used Subroutine: rounding method for polytopes, KcLnnEin's SvP algorithm 

• Apply the rounding method for polytopes with input P. 

The result is D G Q"^" symmetric positive definite and cG Q" . 
Compute a decomposition D~Q^Q of the matrix D. 

• Compute a shortest non-zero lattice vector d G i^{Q) using Kannan's SvP 
algorithm. Let J := G . 

• Set w := 2\\d\\2- 

If w>n, output that P contains an integer vector. 

Otherwise output d G together with fc,„in := \{d,c) — 2n\\d\\2] and fcmax l{d,c) + 



Theorem 7.7. f Theorem \ 5. 1\ restated) 

Given a full- dimensional polytope P C IR,", the flatness algorithm for polytopes outputs one of 
the following: 

• Either it outputs that P contains an integer vector or 

• it outputs a vector d G and an interval Ip of length at most 2v? such that P contains 
an integer vector if and only if there exists k G Z D Ip such that P ^ contains an 
integer vector. 

The number of arithmetic operations of the algorithm is s'^^"'^^ log2(r)2'^(") and each number 
computed by the algorithm has size at most r"'^ ^' , where r is an upper bound on the size of the 
polytope and s is the number of constraints defining the polytope. 

Proof. As we have seen in Proposition 17. H the value w is the width of an approximate Lowner- 
John ellipsoid E of the polytope P. The algorithm computes this value and distinguishes between 
two cases: 

If i(; > n, it is guaranteed by the flatness theorem that E and therefore P contain an integer 
vector, see Theorem 17.21 

If < n, the algorithm outputs a vector d € together with an interval Ip = [fcmin) ^max]- 
This interval contains all integers G Z such that the hyperplane H^^ ^ intersects the ellipsoid 
2n-k E(D,c). It follows from P C 2n-k E{D,c) that it also contains all integers k £ Z such that 
the hyperplane H^,^ intersects the polytope P. Since the width of the ellipsoid E{D,c) along 

the vector d is at most n, the width of the ellipsoid 2n -k E{D,c) along d, which is an upper 
bound on the length of the interval, is at most 2n'^. 

According to Theorem 17. 6| the size of an approximate Lowner- John ellipsoid of the polytope P 
computed by the rounding method is at most 



In fact, the flatness algorithm for polytopes combines the flatness algorithm for ellipsoids for the 
ellipsoid E{D,c) and the ellipsoid 2n-k E{D,c). Hence, it follows from Proposition 17.31 that the 
size of each number computed by the algorithm is at most 



2n\\d\\2\. 



2^("')size(P)^(") <2^("')r^W. 
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The number of arithmetic operations is dominated by the number of arithmetic operations of 
the rounding method for polytopes and Kannan's SVP algorithm. Hence, we obtain 

(n • sf^^^ log2(r) + n"/(2e)+o(n) ^ log2(r)n"/(2e)+o("). 

□ 

7.3 A flatness algorithm for £p-Bodies 

To obtain a flatness algorithm for ^p-bodies we need to be able to compute approximate Lowner- 
John ellipsoids for £p-bodies. 

7.3.1 Computation of Lowner-John Ellipsoids for ^p-Bodies, 1 < p < oo 

The algorithm that computes approximate Lowner-John ellipsoids for £p-bodies is based on 
a variant of the shallow cut ellipsoid method due to |GLS93| . This algorithm computes in 
polynomial time a ^/n{n + l)-approximate Lowner-John ellipsoid for any well-formed convex 
body given by a separation oracle. That means, we assume that the algorithm has access to 
an oracle that decides for a given vector whether it is contained in the convex set or not. If 
the vector is not contained in the convex set, it provides a hyperplane that strictly separates 
this vector from the convex body. To obtain an approximation factor linear in n rather than 
of the norm n^/^ as in | IGLS93| . we combine the result of |GLS93| with an idea of |HK10| and 
|Koc94) . Unlike the original approach of |GLS93) . this approach leads to an algorithm whose 
number of arithmetic operations is single exponential in the dimension, but in our situation this 
is irrelevant. 

Theorem 7.8. There exists an algorithm which satisfies the following properties: Given a full- 
dimensional bounded convex set C C IR," by a separation oracle together with rj„,i?out > and 
Cout £ such that C C Bn\cout, Rout) CLiT'd vol„(C) > vol„ (0, 1)), the algorithm com- 
putes a in-approximate Lowner-John ellipsoid. The number of arithmetic operations of the algo- 
rithm is dominated by the number of calls to the oracle, which is at most log2(-Rout/?'m)'^^^^2^^"'\ 
The algorithm requires polynomial space and each number computed by the algorithm has size at 
most 2^{"^)(i?outM„)^(i). 

To apply Theorem l7.8l to ^p-bodies, we need to realize a separation oracle for this class of convex 
sets. Additionally, we need to determine parameters Rout, ''"in > and a vector Cout S such 
that an £p-body Bml^\t,a) is contained in an -^2~t)all with, radius Rout CGntBred. at Cout 

and such 

that the volume of an £p-body Bm'^\t, a) is at least times the volume of the m-dimensional 
Euclidean unit ball. We have already seen in Lemma [6.31 how we can construct for an £p-body a 
circumscribed ^2-ball. Now, we prove a lower bound on the volume of an £p-body provided that 
it contains an integer vector. The lower bound depends on the shape of the convex set, that 
means on the parameters defining it, and on the radius of a circumscribed Euclidean ball. For 
the proof of the lower bound, we consider a special representation of the £p-body. If we consider 
the following convex function, 

F:R^'"^R, a2V-\{x^,0'^-'^f -t)\\P-aP^, (7.4) 

where V G R"^" nonsingular, t € R," and an,Oici G N. Then we have Bm'^\t,a) = {x G 
W^\F{x) < 0} with a := an/ad- 

To illustrate the main idea of the proof, which is due to Heinz |Hei05| . we imagine that the 
function F is in addition differentiable and that we know an upper bound M on the length of 
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its gradient Vi^(x), x E R™', i. e., ||V-F(2;)||2 < M for all x £ IR™'. Further, we assume that we 
know some parameter e > such that there exists a vector x G R" with F{x) < — e < 0. 

Since for every convex function the first-order Taylor approximation is a global underestimator 
of the function (first-order convexity condition), we obtain for all x S that 

F{x) > F{x) + VF{x)'^{x - x). 

Using the Cauchy-Schwarz inequality this yields the upper bound 

F(x) < F{x) + VF(x)^(x -x) <-e + M\\x - x\\2. 



Hence, if a vector x G R™' satisfies \\x — x\\2 < ^/M, then F{x) < and it is contained in the set 
Bmln\t,a). This shows that Bmln\t,0!) contains an Euclidean ball with radius e/M centered 
around x and that the volume of Bm',n^ {t, a) is at least (e/M)'" vol™(S^^(0, 1)). 



For the function F defined in (|7.4p we can compute such a parameter e since we can show 
that there exists an integer K such that for all x £ there exists an integer K' < K such 
that K ■ F{x) E Z. That means for every integer vector x G Z™, F{x) is a rational number 
with denominator at most K. Hence, if Bm%\t,<y) contains an integer vector x G Z™, then 
Fix) < —1/K < 0. In the following claim, we give an upper bound on the number K. A proof 
of it appears in the appendix. 



Claim 7.9. Let F : R*" — ^ R 6e a function defined as in ([7.^|) given by a non-singular matrix 



V G Q"^", a vector t G Q"' and an, ad G N. Let S be an upper bound on the size of V , t, an 
and Oil- Then, there exists an integer K < S"^^ ^ such that K ■ F{x) G Z for all x G Z™. 

Now, the main remaining problem is that the function F defined in (|7.4p is not differentiable. 
Hence, we cannot apply the idea of Heinz directly. We need to modify the idea described above 
and work with the subgradient instead of the gradient. We start with a short overview about 
subgradients. 

Definition 7.10. Let f : R" — R 6e a convex function and x G R". A vector g G R" is called 
a subgradient of f at x, if the following holds, 

f{z) > f{x) + {g,z- x) for all z G R''. (7.5) 

The inequality (|7.5p is called subgradient inequality. Geometrically, this inequality means that 
the graph of the affine function z i— )■ f{x) + {g,z — x) is a supporting hyperplane of the epi- 
graph of / at {x,f{x)). If / is differentiable, then the subgradient is unique and it is simply 
the gradient of / at x. For a more detailed introduction into subgradients see |Roc70) and |Pol87] . 

Using the subgradient inequality, we can prove a lower bound on the volume of the set Bm,n\t, a) 

(2) 

under the assumption that for all i? > and y G Bm {0, R), the length of a corresponding 
subgradient is bounded. 



Lemma 7.11. Let Bm')^\t,a) be an £p-body given by V £ Q"^" nonsingular, t G Q", a = 
OLnloLd > and 1 < p < oo. Let F : R"* — )• R 6e a function defined as in ^7.4\ )- Let S be 
an upper bound on the size of Bmln\t,a). Let R> such that Bmln\t, a) is contained in an 
Euclidean ball with radius R centered at the origin. Assume that there exists M G R such that 

(2) 

the following holds: For all y G Bm {0,R) there exists a subgradient g G R™ of F at y which 
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satisfies \\g\\2 < M. 

If Bm'^\t,a) contains an integer vector x € Z™', then 

vol„(S^;^)(t,a)) > (52"'PM)— •vol™(i?(?)(o,i)). 

(2) 

Proof. Let g G ]R'"\{0} be a subgradient of F at the vector y £ Bm {0,R) which satisfies 
II (7 II 2 < M. Then it follows from the subgradient inequality (|7.5p for x G Z*" that 

F{x) >F{y) + {g,x-y). 

As we have seen in Claim [7l9| F{x) is a rational number with denominator at most S^^^^. Since 
F{x) < 0, we obtain using the Cauchy-Schwarz inequality 

F{y) < F{x) + {g,y-x)< -S-^^'P + \\g\\2 ■ \\y - xh < -S'^'^'^ + M\\y - xh 

which shows that every vector y G Bm\o,R) with \\y — x\\2 < S~'^"'^P/M satisfies F{y) < and 
is contained in Bm,n\t, a). 

Hence, the £p-body Bmln\t,a) contains a ball with radius (S'^"^^M)~"^ centered at x and the 
claimed lower bound for the volume follows directly. □ 

To obtain a lower bound on the volume of Bm')i^\t,a) we need to compute for every vector 

(2) 

y G Bm {0, R) an upper bound on the length of a corresponding subgradient of F which depends 
only on the parameter R. For this, we need to develop an explicit expression of a subgradient 
of the function F defined in (|7.4p . We start with the computation of the subgradient of the 
following simple function. 

Lemma 7.12. Let y G R" and I < p < oo. Then a subgradient g G R" of the function 
Fp : R" — )• R, j; I— )• l^il^ at the vector y is given by g = {gi, . . . , gn)^ , where gi := 

sign(yj) • \yif~^- 

The proof consists of showing that the vector g satisfies the subgradient inequality. For complete- 
ness, it appears in the appendix, see Section IA.5I To compute the subgradient of the function 
F defined as in (|7.4p . we combine this result with the following lemma, which shows how the 
subgradient changes if we consider an affine transformation of the variables or the function. 

Lemma 7.13. Let f : R" — R 6e a convex function. 

• Let hi : R" — t- R defined by hi{x) := f{Ax + b), where A G R*^^" is a nonsingular matrix 
and b G R". Let gi G R"' be a subgradient of f at the vector Ay + /?. Then, the vector 
A^gi is a subgradient of hi at the vector y. 

• Let /i2 : R" — > R defined by h2{x) := a ■ f{x) + /3, where a G R\{0} and /3 G R. Let 
g2 G R" be a subgradient of f at the vector y G R" . Then ag2 is a subgradient of /12 at the 
vector y. 

The proof of this lemma is straightforward since we need to show that the vectors A'^gi and 
ag2 satisfy the subgradient inequality. If we apply this result with A = V~^, j3 = —V~^t and 
a = a^, 6 = On, and restrict the subgradient to its first m coordinates we are able to give an 
explicit expression of the subgradient of the function F. 

Lemma 7.14. For m,n G ¥1, m < n, a subgradient at the vector y G R'" of the function 
F -.W^ -^U, x^ a2||F-i((x^,0"-™)^ - t)||^ - a?,, where V G R"""" is nonsingular, t G R" 
and 1 < p < 00, is given by the vector a^g G R™" defined by g = (V'~^)"^5{i,...,m}) where g G R" 
IS defined by g, = sign([y-i(y - t)]i) ■ \[V'\y - t)]^\P. 
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Using this explicit expression of the subgradient, we are able to give an upper bound on its 
length. The proof of the following lemma appears in the appendix, see Section IA.5I 

Lemma 7.15. For m,n £ ¥1, m < n, a subgradient at the vector y £ of the function 
F -.W^ ^R, a2||y-i((x^,0"-™)^ - - a^, where V G R"^" is nonsmgular, t G E," 
and 1 < p < oo, is given by the vector a^g G defined by g = (^~"^)'^ff{i,...,m}7 where g G R"" 
IS defined by g, = sign([y-i(y - t)]i) ■ \[V-\y - t)]i\P. 
If ye Bin\0,R) C R*^, then 

where S is an upper bound on the size of and t. 

Using this upper bound together with Lemma 17.111 and the upper bound of a radius of a cir- 
cumscribed Euclidean ball, we get the following lower bound on the volume of Bmln\t, a). 

Lemma 7.16. Let Bm%\t,ct) be an ip-body, where t G R", V G Q"^" is nonsingular, a G Q"*" 
and \ <p < oo. If Bmln\t,C() contains an integer vector, then its volume is at least 

Yo\^{B^Z^\t,a)) > (s2("'+2)m2n2||y||)~"^''^'^ voU(i?i2)(0,l)), 
where S is an upper bound on the size of and t. 

Proof. It follows from Lemma [6. 3 1 that the convex body Bmln\t, a) is contained in an Euclidean 
ball centered at the origin, whose radius is at most + mS. Hence, if we choose R : = 

a^/nm\\V\\ • S, then the Euclidean ball Bm\o,R) contains Bmln\t,a). Combining this with 
the result from Lemma I7.15| the statement follows directly from Lemma 17.111 □ 

To compute approximate Lowner-John ellipsoids, we need to be able to compute separating 
hyperplanes. The following result gives a relation between this problem and the computation of 
subgradients. 

Lemma 7.17. Let f : R" — )■ R 6e a convex function and Ca '■= {x G R"|/(x) < a} for some 
a > be the corresponding convex body. Let y G R"' with y Cq,. Then, any subgradient g G R*^ 
of f at y defines a hyperplane that separates y from Ca, i-e., {g,x) < {g,y) for all x G Ca- 

The proof of this lemma follows directly from the subgradient inequality (|7.5p . Hence, Lemma 
17.141 vields to an efficient realization of a separation oracle for an £p-body. Together with the 
results from Lemma [6. 3 1 and Lemma r7.16[ this shows that we can use the algorithm from Theorem 
17.81 To obtain an algorithm that computes an approximate Lowner-John ellipsoid for ^p-bodies. 

Theorem 7.18. (Rounding method for ip-bodies) Let Bm')^\t,a) be an £p-body given by a 
nonsingular matrix V G Q"'^"^, t G Q", a > and 1 < p < oo. Then, there exists an algorithm 
that given such an tp-body outputs one of the following'. 

• Either it outputs that Bmln\t,a) does not contain an integer vector, or 

• it outputs a Am- approximate Lowner-John ellipsoid in form of a positive definite matrix 
D G (Q™'^'" and a vector c G Q™'. In this case, the size of the ellipsoid is at most 

The algorithm uses polynomial space and its number of arithmetic operations is at mostp{n log2(r))'^(^)2^(™') . 
Here, r is an upper bound on the size of the £p-body. 
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7.3.2 Description and Analysis of the flatness algorithm for ^p-bodies 

Using this result, we obtain a flatness algorithm for ip-hodies in the same way as we obtain the 
flatness algorithm for polytopes, see Algorithm [71 

Algorithm 7. Flatness Algorithm for ^p-bodies 

Input: An ^p-body Bmln\t,a), where F G Q"^" nonsingular, t e Q." , a > 0, I < p < oo . 
Used Subroutine: Rounding method for ^p-bodies, Kannan's Svp algorithm. 

Apply the rounding method for £p-bodies with input Bm',n\t, a) . 

If it outputs that Bm'n\t, ce) does not contain an integer vector, then output this. 
Otherwise, the result is Z? g Q™'*™ symmetric positive definite and c G (Q™ . 

• Compute a decomposition D^Q^Q of the matrix D. 

• Compute a shortest lattice vector d € C{Q)\{0} using Kannan's Svp-algorithm. 

Let d:=Q-^de Z™. 

• Set w := 2\\d\\2. 

If w>m, output that Bmln\t,a) contains an integer vector. 

Otherwise output d e together with kmin \{d,c) — 4:m\\d\\2] and fc,nax := [{d,c) + 
4rn||d||2j . 



Theorem 7.19. (Theorem restated) Given as input an £p-body Bm^n {t,a), the flatness 
algorithm for ip-bodies outputs one of the following: 

• Either it outputs that Bmln\i,ct) does not contain an integer vector, or 

• it outputs that Bm^\t, a) contains an integer vector, or 

• it outputs a vector d € and an interval 1^ of length at most Am? such that Bmln\t, a) 

contains an integer vector if and only if there exists k G Zn/g such that Bm,n\t, a)r\Hj^ j 
contains an integer vector. 

The number of arithmetic operations of the algorithm is 

p- (nlog2(r))'^(i)m™/(2^)+°(") 

and each number computed by the algorithm has size at most r^"'^'^' , where r is an upper bound 
on the size of the ip-body. 

Proof. Obviously, we can assume that the rounding method computes an approximate Lowner- 
John ellipsoid. For this ellipsoid E, the algorithm computes a flatness direction as well as its 
width w, see Proposition 17.11 Then the algorithm distinguishes between two cases: 
If w > m, it is guaranteed by the flatness theorem that E and therefore Bm'^\t, a) contain an 
integer vector, see Theorem 17.21 

Otherwise, we have w < m and the algorithm outputs a vector d G Z"* together with an inter- 
val Jg = [/cmiiii ^max]- This interval contains all integers k £ Z such that the hyperplane -ff ^ j 

intersects the ellipsoid Am -k E{D,c). Since Bm'^\t,a) C Am -k E{D,c), this interval contains 
also all integers A; G Z such that i/^ ^ intersects the ^p-body. Since w{E) < m, the length of the 
interval is at most 4m^. 

According to Theorem 17.181 the size of an approximate Lowner-John ellipsoid computed by 
the rounding method is at most 2^^"^ )^0{n p) gij^Qg flatness algorithm is a combination 
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of the flatness algorithm for ellipsoids applied with the inscribed ellipsoid E(D,c) and the 
circumscribed ellipsoid 4m^ -k it follows from Proposition 17.31 that the size of each number 
computed by the algorithm is at most 

The number of arithmetic operations is dominated by the number of arithmetic operations of 
the rounding method for ^p-bodies and by the number of arithmetic operations required by 
Kannan's SVP algorithm. Hence, it is upper bounded by 

p{n ■ log2(r))^(i)2^(™) + m"^/(2e)+o(m) ^ p(n log2(r))^(i)m™/(2e)+o(m) _ 

□ 

Using this rounding method, we obtain a flatness algorithm for £p-bodies. Hence, our assump- 
tions made in Section |6] are satisfied and there exists a deterministic algorithm that solves Lmp 
for balls generated by an ^p-norm, 1 < p < oo. As stated in Theorem 13.31 this leads to a deter- 
ministic algorithm that solves CVP with respect to an £p-norm with 1 < p < oo. In the same 
way, we obtain a deterministic algorithm that solves Lmp for polytopes and a deterministic 
algorithm for CvP for all polyhedral norms, e.g. the ^i-norm and the ^co-norm. 

Acknowledgment. We thank Friedrich Eisenbrand for several stimulating discussions that 
greatly benefited the paper. 
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A Appendix 

A.l Projection for non-Euclidean norms 

If we consider other norms than the Euclidean norm, we had to differ between two types of 
norms on the vector space R": The norms which are induced by a scalar product or inner 
product and the norms which are not. A norm on R"^ is induced by a scalar product, if for all 
X G R", ||x|| = y'ix^x), where (•, •) : R" x R"^ — t- R denotes a scalar product. Particularly, all 
£p-norms with p ^ 2 are not induced by a scalar product. The norms on R" which are induced 
by an scalar product are exactly that norms whose unit ball is an elhpsoid. For such norms the 
solution of the closest vector problem can be easily reduced to the solution of the closest vector 
problem with respect to the Euclidean norm using the fact that each ellipsoid is the image of 
the Euclidean unit ball under a bijective affine transformation. 

If the norm is not induced by a scalar product it does not seem to be possible to use projections 
for algorithmic solution of the closest vector problem. 



We start with a description of the situation and show how we can use projections if we consider 
the closest lattice vector problem with respect to a norm induced by a scalar product. Then, 
we give a counterexample why dimension reduction it does not seem to work for norms which 
are not induced by a scalar product. 
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Figure 1: Projection in a subspace. The vector t lies in span(6i, . . . , The vector t± 
denotes the orthogonal projection of t in span(6i, . . . 

In the following, we assume that we are given a vector space span(6i, . . . , 6„), where 61, . . . , 6„ 
are linearly independent, a target vector t S span(6i, . . . , bn) and a lattice L = C{bi, . . . , bn-i)- 
We are searching for the lattice vector in L, which is closest to t, see Figure lATTl for an illustration. 

In this situation, the distance between the target vector and the lattice can be arbitrarily large. 
In order to handle this problem, we consider the orthogonal projection of t in span(5i, . . . , 
which is given by 



i± = t-nn{t)=t-^§^bl (1.6) 
{bii,bh^ 



where bn is a vector orthogonal to span(6i, . . . ,6„_i) with respect to the corresponding scalar 
product, for example the n-th Gram-Schmidt- vector of the basis [61, . . . , 

If we are searching for a solution of the closest vector problem with respect to a norm that is 
induced by a scalar product, it is easy to prove the following: 

Proposition A.l. Let \\ ■ \\ be a norm on R" induced by a scalar product. The vector v € L is 
a closest lattice vector to t if and only if v is a lattice vector in L closest to the projection t' of 
t in span(6i, . . . , 

Proof. Let y G L C span(6i, . . . , be the closest lattice vector to t'. Since the norm is 

induced by a scalar product, we have ||t — y|p = {t — y,t — y), where t — y = i± + {t, bn) / {bn, 6n)6n. 
Hence, 

\\t-yf = {h - y,h -y) + 2-§4t^^- ^"^ " + ^7S4t^«' 7§4t^«)- 

{bk,bii} (On,On) (On, On) 

Since bn is orthogonal to — y G span(L), we get 

\\t - y||2 = \\t, - y||2 i 11 J^l^ftt ||2 

\\t y\\ \\t^ y\\ +ll^^t,^t)MI ' 

where the term \\{t,bn) / {bn,bn)bn\\'^ is independent of the choice of y. Hence, we see that — 
is minimized over v £ L if and only if — v\\ is minimized over L. □ 

To show that this statement is not true if the norm is not induced by a scalar product, we give 
a counterexample. Additionally, we show that this statement is not true, if we consider the 
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Figure 2: Counterexample for projections with respect to the ^i-norm. We consider 
the lattice spanned by the vector bi, together with the target vector t. The vector t± is the 
orthogonal projection of t in span(6i), tmin is the £i-projection. 

corresponding norm projection instead of the orthogonal projection: As the norm projection of 
a vector in a subspace we understand that vector in the subspace with minimal distance with 
respect to the corresponding norm, i. e., we consider the vector in span(L) which is closest to t 
with respect to the corresponding norm: 

imin G span(L) with min — (1-7) 

2'Gspan(L) 

Mangasarian gave an explicit closed form for this projection, (see |Man99] ). If we consider a 
norm induced by a scalar product then the norm projection and the orthogonal projection co- 
incide. Additionally, we need to observe that if the norm is not strictly convex, then the norm 
projection might not be uniquely determined! 

The following counterexample considers the closest vector problem with respect to the ^i-norm, 
which is very descriptive. But there exists also counterexamples for norms, which are not strictly 
convex, for example for the ^3-norm. They will appear in the full version of this paper. 

We consider the and the lattice spanned by the vector bi = (4,7)"^ G R^. Additionally, we 
consider the target vector t = (0,5)^ G R^, which is not contained in the subspace span(6i). 
We are searching for a lattice vector in C{bi) which is closest to t with respect to the £i-norm, 
see Figure lA.ll for an illustration. 

Claim A. 2. The vector v = is the closest lattice vector to t in C{bi) with respect to the 
ii-norm. 

Proof. Every lattice vector v € C{bi) is of the form v = vibi = (4i;i,7T;i)'^ with € Z. With this 
representation, the distance between t and a lattice vector is given by fi6i||i = 4|ui|-|-|5 — 7wi| 
and it becomes minimal over Z, if ui = 0. □ 

Now we consider the orthogonal projection t± of t in span(6i) with respect to the Euclidean 
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norm, (see (|1.6p ). The vector (—7,4)^ is orthogonal to bi. Hence, t± is given by 



t± = t- 




Now, we are searching for the closest lattice vector to t± with respect to the £i-norm. Obviously, 
in a lattice of rank 1, we get the closest lattice vector by rounding. Hence, 

Claim A. 3. The vector bi is a closest lattice vector to i± = 7/13 • (4,7)"^ in L = C{bi) with 
respect to the li-norm. 

Hence, this is an example where the lattice vector which is closest to t is not the lattice vector 
which is closest to the orthogonal projection of t in the lattice. Now we consider the vector 
tmin £ span(6i) which is closest to t with respect to the ^i-norm, as defined in (|1.7p . 

The £i-projection of a point t onto a subspace S depends of the orientation of the subspace. In 
IR^, when the angle 6 is different from 7r/4, the projection is unique but directly along the y-axis 
or the X-axis. When 9 = 7r/4, the projection is a segment and it includes the points along both 
unit directions. 



In our example, we obtain 

min \\t — x\\i = min 11 ( ? ) — a^i ( ^ ) Ih = min 4|xi| + |5 — 7xi\. 

Sespan(6i) xieR \ ^ / V ' / xi&R 

This value becomes minimal, if xi = 5/7. Hence, tmin = f • (4,7)"^. Obviously, we get 

Claim A. 4. The vector bi = (4,7)-^ is the closest lattice vector to tmin in ^{bi) with respect to 
the ii-norm. 

Hence, this is additionally an example, where a lattice vector that is closest to t is not closest 
to the target vector tmin which is the ^i-projection of t in span(L). 



A.2 Technical Stuff 

To prove the statements in the appendix, we use some facts about the change of the representa- 
tion size under basic matrix operations. We state them in the following. For a proof of results 
of this type see for example |GLS93) or |Sch86) . 

Claim A. 5. 

• Let AG Q"^". Then, sme{A-^) < n"/^ size(^)"("-i) . 

• Let A G Z™^", x,y G Z". Then, size(x-l-y) < size(x) -|-size(y) andsize{Ax) < n-size(^)- 
size(x). 

• Let A G Q"^^", x,y G Q"'. Then, size(3; + y) < 2size(x) • size(y) and size{Ax) < (2 • 
size(j4) • size(x))". 

• Let P C ]R" be a full- dimensional polytope centered about the origin and x G R". Then, 
\\x\\p < n • size(P) • size(x). 
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A. 3 Selfreducibility of the Closest Vector Problem 

Since lattices are discrete objects, for the proof of Theorem 13.31 it is enough to show that there 
exists a polynomial reduction from the closest vector problem to the decisional vector prob- 
lem. In the decisional closest vector problem, we are given a lattice L and some target vector 
t G span(L) together with some parameter r > and we need to decided whether the distance 
from the target vector to the lattice is at most r. 

The reduction from the closest vector problem to the decisional closest vector problem uses as a 
intermediate problem the optimization variant of the closest vector problem. In the optimization 
closest vector problem (OptCvp'-H'II-'), we are given a lattice L and some target vector t S 
span(L) and we are asked to compute the minimal distance from this target vector to the 
lattice. 

The reduction from the closest vector problem to the decisional closest vector problem consists 
of a reduction from the optimization closest vector problem to the decisional closest vector 
problem, which we will present in Section IA.3I and a reduction from the optimization closest 
vector problem to the closest vector problem, (see Section [A.3p . 

Reduction of the Optimization Closest Vector Problem to the Decisional Closest 
Vector Problem The reduction from the optimization variant to the decision variant of the 
closest vector problem is based on binary search. This binary search is performed on the set of 
all possible values which can be achieved by the norm of an integer vector, if the norm lies in 
some certain interval. Hence, we need to ensure that we are able to enumerate all these values 
and we need an upper bound on the cardinality of such a set - depending on the size of the 
interval. To guarantee all that, we consider special norms which we call enumerable. In general, 
we call a function enumerable, if it maps every integer vector to a discrete enumerable set. 

Definition A. 6. A function f : R" — )• Rq is called (k, K)-enumerable for parameters k,K £¥i, 
or simply enumerable, if there exists K G ¥1, K < K , such that 

k ■ f{xf £ No for all x E Z". 

Obviously, every ^p-norm, 1 < p < oo, is (A:, l)-enumerable with k = p for 1 < p < oo and k = 1 
for p = oo. Later, we will show that also all polyhedral norms are enumerable. 

Proposition A. 7. Let \\ ■ \\ be a {k, K) -enumerable norm on R". Assume that there exists an 
algorithm Aoec that for all lattices C{B') C of rank m, all target vectors t' G span(i?') n 
and all r > solves the decisional closest vector problem in time Tm^n {S' ,r), where S' is an 
upper bound on the size of the basis B' and the target vector t' . 

Then there exists an algorithm that solves the optimization closest vector problem for all lattices 
L = C{B) C Z", B = \bi, . . . , bra], oind all target vectors t £ span(L) n in time 

O (fc • log2(| • max ||6,||) + log2(i^)) • n^^'^ • Ti}\S, ^ • max 

where S is an upper bound on the representation size of the basis B and the target vector t. 

Proof. Let B = \bi, . . . , bm] C be a lattice basis of the lattice L and t G span(L) n a 

target vector. Without loss of generality, we assume that t ^ L, i.e., L) > 0. 

As an upper bound for the distance between t and the lattice, we can choose 

R := — max{||6j |||1 < j < m}. 
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(see |Cas71) ). since t £ span(L). We have L <^ and t G Z". Hence, the distance vector of t 
and its closest lattice vector is an integer vector. Using that || • || is a (A:, i^)- enumerable norm, 
we obtain that the distance is of the form 

L) = ^J^, where p, g G N with gcd{p,q) = 1 and I < q < K. 

Hence, we are able to perform a binary search using the algorithm ^Dec to find fx^^^'^^\t, L). The 
number of calls to the algorithm Aoec is at most C'(log2(-R'^ • K'^)), since we are finished if the 
length of the current interval is less than 1/K'^. As a consequence, the running time to solve 
OptCvp is 

O {k . log2(i?) + 21og2(K)) • n^(i) • Tji-J\S,R). 

□ 



Reduction of the Closest Vector Problem to the Optimization Closest Vector Prob- 
lem Now, we will present a reduction from the search variant to the optimization variant of 
the closest vector problem. The running time of this reduction depends on the knowledge of 
non-decreasing functions c, C : N — )• R^" such that c(n) • ||2;||2 < < C(n) • ||x||2 for all 
X G R". In what follows, if the parameter n is obvious by the context, we will omit it and we 
will write c or C instead of c(n) or C{n). Geometrically, these functions can be interpreted as 
the radius of an inscribed or circumscribed Euclidean ball of the unit ball of the norm || • ||. 

Proposition A. 8. Let || • || he a norm on R" and c,C : N — )• R^*^ be non- decreasing functions 
such that c(n) • ||2;||2 < ||x|| < C(n) • ||a;||2 for all x G R"". 

Assume that there exists an algorithm ^Opt; ihat for all lattices C{B') C of rank m and all 
target vectors t' G span(i?') n solves OptCvp^H'H-' in time Tm^n{S'), where S' is an upper 
bound on the size of the basis B' and the target vector t' . 

Then there exists an algorithm A! that solves the closest vector problem for all lattices C{B) C 
of rank m and target vectors t G span(i3) n in time 

2m ■ log2 (mV^ • (C • c'^) ■ S) ■ T^Jl}\l&m^n ■ {C ■ c'^fS^), 

where S is an upper bound on the size of the basis B and the target vector t. 

The idea of the reduction is to modify the lattice basis such that the lattice becomes thinner 
and thinner. Simultaneously, the distance between the target vector and the lattice remains the 
same. We repeat this until the lattice is so thin such that we are able to compute the closest 
lattice vector in polynomial time. 

Before proving Proposition IA.8| we will show that a closest lattice vector can be computed 
efficiently if the lattice is thin enough. That means, we consider special CVP^"' "^-instances, 
where the distance between the target vector and the lattice is small compared with the minimum 
distance of the lattice. 

Lemma A. 9. Let z G N. Let B C 2*2"^™' be a lattice basis of rank m and t G span(i?) n 
a target vector. Let \\ • || be a norm on R" and c : N — t- R^*^ be a non- decreasing function such 
that \\x\\ > c{n) ■ \\x\\2 for all x G R". Let 

i>l + l0g2(/x(ll-ll)(t,£(i3)))-l0g2(c). 

If we consider the following representation oft = X]j=i Pfl^^j> then the vector v := X]j=i Wj^ ^'^j 
is the closest lattice vector to t in C{B) with respect to norm \\ ■ \\- Especially, the closest lattice 
vector to t in C{B) with respect to the norm \\ ■ \\ can be computed in polynomial time. 
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Proof. To prove the lemma, we consider the lattice 2*Z" and show that there exists exactly 
one vector, whose distance to t is at most fi^^^'^^\t, C{B)), namely the vector v. Since C{B) is 
a sublattice of 2*Z", the statement follows. We show that v G 2*Z" is the only vector in 2*Z" 
whose distance to t is at most /^^"■"■'(t, C{B)) by showing that the distance of every lattice vector 
in 2*Z"\{u} is greater than ^i^^W-W^t, C{B)) > /i(IHI)(t, 2*Z"). 

We consider a lattice vector u G 2'Z"'\{u}, together with its representation as a linear integer 
combination of the standard basis of the lattice 2*Z", u = X]j=i ^j^^^i with Uj G Z, 1 < j < n. 
Since u ^ v, there exists an index k, 1 < k < n, where the coefficient Uk is not the nearest integer 
of the coefficient /3j, i.e., Uk ^ [f^kl- Using the function c, we can show that this coefficient is 
responsible, that the distance between the target vector t and this lattice vector is larger than 
fi(\\-\Ht,C{B)): 

n 2 

||n - if > c2 . II ^{u, - W,])2^e,\\l > ■ \uk - Wk] \'2^' = j • 
i=i 

Since the value i satisfies i > l+log2{fJ-^^^'^^\t, C{B)))-log2{c), we obtain 2'--^c > /Li(IIH)(t, £(5)), 
which shows that ||n - f|| > fj,^^\-\\\t, C{B)). □ 

Now we are able to give a reduction from the closest vector problem to the optimization closest 
vector problem. In the reduction, we will transform the given CvP-instance into a new CVP- 
instance, which satisfies the assumptions from Lemma IA.9I Additionally, both CvP-instances 
will have the same distance between the target vector and the lattice. Hence, we are able to 
conclude from the solution of the new CvP-instance to the solution of the original instance. 

Proof, (of Proposition lA.Sp 

We are given a lattice basis B G Z"^™ and a target vector t G span(S). Using the algorithm 
-^Opt with input B and t, we can compute 

/x:=A.(ll-!l)(t,£(i?)). 

Without loss of generality, we can assume that fi ^ 0, i.e., t ^ C{B). 
Assume that we are able to construct a sequence of CvP-instances 

{Bi,ti), 0<i< imsLx := riog2(m • max ||6j||) + 2 - log2(c)], 

J 

where each tuple satisfies the following properties: 

Bi = 2'B C 2*Z", ti-t£ C{B) and n^\\-\\\ti, C{Bi)) = fi. (1.8) 

Since the distance between the target vector t and the lattice C{B) is at most m ■ max{||6j || |1 < 
j < m}, each index z G N with i > imax satisfies that i > log2(;u) + 1 — log2(c). Hence, the 
C VP-instance {Bi^^^,ti^^^) satisfies the assumptions of lemma [A.9I and a closest lattice vector 
to ti^^^ in the lattice C{Bi^^^) can be found efficiently. Using a solution of this CvP-instance, 
we are able to compute a closest lattice vector to t: If Xi^^^ G C{Bi^.^^) is a solution of this 
CvP-instance, then the vector x := Xi — {ti — G C{B) is a solution of the CvP-instance 
{B,t). 

Hence, it remains to show how to construct a sequence of CvP-instances {Bi,ti) satisfying the 
properties stated in (jl.Sp : As initialization, we set Bq := B and Iq := t. Then, we continue 
inductively. For simplicity, we describe the construction only for {Bi,ti). 

The basis Bi = 2Bq is constructed in m steps and in each step we construct a CvP-instance 
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Construction: 

Input: CvP-instcLtice (_Bo,^o) 
Set Bq := Bq and Iq :— to . 
For 1 ^ _7 ^ • 






. C-i-a-»— 1- J„ TT-i -t-Vi -inTm-f- ( 1-i ■ f tt>iot-c» iR ■ — \0h^ 

The algorithm computes ii{Bj,tj^i) . 




h 1 


• If ^{Bj ,tj^i) ^ fi, then ij+i '-^ tj . 
Otherwise tj^i tj — bj . 






Output: Cvp-instance {Bm,tm) ■ 







Figure 3: Construction of a new Cvp-instance 



{Bj,ij), < j <m such that {BqJq) = {Bo,to) and {Bm,im) = {Bi,ti). 

The construction is done in that way that each constructed instance satisfies the stated proper- 
ties: We have ij - t G C{B) and = fx = for all < j < m. 
Each lattice vector is a linear integer combination of the basis vectors. The idea of the construc- 
tion is to fix in each step on e basis vector bj, 1 < j < m, and to check whether there exists a 
closest lattice vector to t, whose representation uses the vector bj an even number of times. The 
closest lattice vector to t is a linear integer combination of the basis vectors. In each step, we 
fix one basis vector bj, 1 < j < m, and check whether the above representation uses this basis 
vector bj an odd or an even number of times. 

This is done as follows: We consider the lattice which consists of all lattice vectors of the original 
lattice, which have a basis representation which uses the vector bj an even number of times. If 
the distance of the target vector to this lattice is the same as its distance to the original lattice, 
this is the case and we do not change the target vector. This can be checked using the algorithm 
-4,0pt- 

In the other case, we construct a new target vector by t — bj. Obviously, this new target vector 
has the same distance to the new lattice as the original target vector to the original lattice. 
But we need to be aware of the following: It is not possible to make the decisions described 
above independently: If there exists several lattice vectors which are closest to the target vector, 
then in general they have a different representation as a linear combination of the basis vectors. 
Here different is meant with respect to the parity of the coefficients. Hence, the construction 
need to be done sequentially. For a detailed description and an illustration of the construction 
see Figure [3l 

It is easy to see that the C VP- instance {Bi,ti) satisfies the properties stated in (jl.Sp . This 
proves the correctness of the construction and at the same time the correctness of the algorithm 
for the closest vector problem. It remains to show that the algorithm has the claimed running 
time. 

As described, for the construction of the instance (Bi,ti) from the instance we need 

m calls to the algorithm ^Opt- Hence, the total number of calls to the algorithm ^Opt is rn-i^^^, 
where imax depends on the length of the basis vectors of B. Using the knowledge of the function 
C, we obtain that 

max < C ■ max \\bj\\2 < C ■ \fn- S (1-9) 
using Lemma IA.5I Hence, we get the following upper bound for the number of calls to the 
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algorithm .4opti 

m ■ (log2{m^/n ■ C ■ S) + 2 — log2(c)) < 2m ■ log2{m^/n{C ■ c^^) • S). 

Finally, we need to care about the magnitude of the representation size of the instances: We 
apply the algorithm ^Opt to lattice bases B G Z""^"^, where each basis vector is the original 
basis vector multiplied with a factor 2*, where i < imax- Hence, 

size(S) < size(2*"^'''' size(S)) < 2*'"^'' • S. 

The corresponding target vector t is of the form t — v, where u is a summand of at most m ■ imax 
basis vectors. Hence, if b is the basis vector of B with size(6) = size(-B), then 

size(t) < size(i + ^ 2*'"=''=6) = size(i + m • imax2*"""''6). 
i=i 

Since all vectors are integer vectors, we obtain 

size(t) < size(t) + size(m • i^ax • 2*'"='" 6) < size(t) + m ■ imax • 2*'""" size(5). 

The parameter S is an upper bound on the representation size of the basis B and the vector t. 
Hence, we have 

size(t) < 2m ■ imax • 2*"""" • S 

and the size of each instance is at most 2m ■ imax2*™'"'5' < m ■ 2^*™'"'S'. Using the definition of 
imax, this is upper bounded by 

^ . 22-(iog2(m.max, ||)+2-iog2{c)) . ^ < ^ . . ^ax \\bj\\f ■ 2^ ■ c^^ ■ S = 16m^ max \\bjf ■ • S. 

j 3 

Using the upper bound (|1.9p for the length of the basis vectors, this is at most 

16m^ • • n • 5^ • . 5 < 16 . • n • (C7 • c'^f ■ S^. 
Hence, the running time of the algorithm to solve CvP-Search is at most 

2m • (log2(mV^ • {C ■ c'^) ■ S)) ■ T^;jl\l6m^ n{C ■ c^^fS^). 

□ 

Theorem A. 10. Let \\ ■ \\ be a (k, K) -enumerable norm on R*^ and c, C : N — t- R^*^ be non- 
decreasing functions such that c{n) ■ \\x\\2 < ||x|| < C(n) • ||2;||2 for all x G R". 
Assume that there exists an algorithm Aoec that for all lattices C{B') C of rank m, all target 
vectors t' G span(i?') Pi and all r > solves the decisional closest vector problem in time 
Tm^n{S',r), where S' is an upper bound on the size of the basis B' and the target vector t' . 
Then, there exists an algorithm A' , that solves the closest vector problem for all lattices C{B) C 
of rank m and target vectors t G span(i?) H in time 

n^(i) log2((C • c'^)S) ■ (^k ■ log2(max \\bj\\) + log2(i^) j • T{16m\{C ■ c~^)5^ m ■ max \\bj\\), 

where S is an upper bound on the size of the basis B and the target vector t. 

The corresponding result for all ^p-norms follows directly from a special case of Holder's in- 
equality, which we stated on page |4] It provides also a proof for Theorem 13.31 in the case of 
^p-norms. 
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Corollary A. 11. For all £p-norms, 1 < p < oo, assume that there exists an algorithm Aoec 
that for all lattices C{B') C of rank m, all target vectors t' £ span(i?') n and all r > 
solves the decisional closest vector problem in time Tm^n {S' ,r), where S' is an upper bound on 
the size of the basis B' and the target vector t' . 

Then, there exists an algorithm A' , that solves the closest vector problem for all lattices C{B) C 
in time 

k ■ n^(^) log2{SfT{16m^n^S^, m-nS), 

where k = p for 1 < p < oo and k = 1 for p = oo. Here, S is an upper bound on the size of the 
basis B and the target vector t. 

Proof. Hence, we can apply Theorem lA.lOl with parameter c, C such that C(n) • c(n)~^ < n. 
Additionally, every ip-noim is (k, l)-enumerable with k = p for 1 < p < oo and k = 1 for p = oo. 
Hence, we obtain that there exists an algorithm for the closest vector problem whose running 
time is at most 

n^(^) log2{nS){k • loggCmax • T^lilGm^n^S^ ,m ■ max 

j ' j 

Since the length of all basis vectors bi, 1 < i < n, is upper bounded by ||6i||p < -^^size(6j) < 
-^size(i?) <n-5forl<p<oo and ||6i||oo < size(i?) < S, see for example |GLS93] . we obtain 
the claimed result. □ 

To get the corresponding result for polyhedral norms, we need to show that all polyhedral norms 
are enumerable. This is done in the following lemma. 

Lemma A. 12. Let P C R" be a full- dimensional polytope symmetric about the origin with F 
facets. Let P be given by a set Hp = {hi, . . . , hp/2) C and a set of parameters . . . , f3p/2} C 
N, i.e., 

P = {x e W\{x,hi) < /3i and {x,-hi) < (5i for all 1 < i < F/2}. 
Then \\ ■ \\p is a {l,YlJ/^ f3j)-enumerable norm. 

Proof. Given an integer vector x G Z"\{0}, its polyhedral norm has value r if the following two 
properties are satisfied: 

• The vector x is contained in the scaled polytope r • P, that means {x,hi) < r ■ f3i and 
{x, -hi) < Pi for all 1 < i < F/2. 

• There exists at least one inequality defining the polytope which is satisfied with equality. 
Let J € N, 1 < J < F/2, be such an index. Without loss of generality, we assume that 
{x,hj) = r ■ 13 j. Since {x,hj) G Z, we have r = {x,hj)/f3j G Q. That means, there exists 
p,q GTN with gcd{p,q) = 1 such that r = p/q. Additionally, we know that Pj is divisible 
by q- 

That means, that each value, which can be achieved by the norm || • \\p of an integer vector, is a 
rational of the form p/q with p,q G ¥\, gcd(p, q) = 1 and there exists an index j, 1 < j < F/2, 

rp Icy 

such that q divides fij. Hence, for each vector x E ^ , we obtain that (11^=1 /^i) ' ll^llf ^ ^0- D 

Additionally, we need to compute the radius of an in- and circumscribed Euclidean ball. 

Lemma A. 13. Let P C R" be a full- dimensional polytope symmetric about the origin, 

P = {x G ]R"i(x, hi) < 1 and {x, -hi) < 1 for all 1 < i < F/2}. 

Define P contains an Euclidean ball with radius h := min{||/ij||2 < ^ < centered at the 

origin. 



40 



Proof. Let x G Bn {0,h) = h ■ Bm {0, !)■ Then this vector is of the form x = h ■ x' , where 
x' G R" with ||2;'||2 < 1. Using the Cauchy-Schwarz inequahty, it is obvious that this vector x 
satisfies all inequalities defining the polytope. □ 

Lemma A. 14. Let P C IR," be a full- dimensional polytope given by a vector A £ 2™x" and a 
vector f3 £ Z"*. Let r be an upper bound on the representation size of P. 

Then P ist contained in an Euclidean ball with radius Rout = Vn (n^/^r") centered at the origin. 
For a proof of this statement see Lemma 3.1.33 in |GLS93| . 

Corollary A. 15. Let P C R" be a full-dimensional polytope symmetric about the origin with 

F facets. Assume that there exists an algorithm Aoec that for all lattices C{B') C of rank m 

and all target vectors t G span(i?') Pi solves the decisional closest vector problem with respect 

(P) 

to the polyhedral norm \\ • \\p in time Tm,n{S'), where S' is an upper bound on the size of the 
basis B' and the target vector t' . 

Then there exists an algorithm A' that solves the closest vector problem with respect to the 
polyhedral norm \\ ■ \\p for all lattices C{B) C of rank m and target vectors t G span(i?) n 
in time 

F ■ log2(P • S) ■ Tg2(16 • m3n"+2 size(P)"+^ • 5^ n • m • 5 • size(P)), 

where S is an upper bound on the size of the basis B and the target vector t. 

This corollary provides also a proof of Theorem 13.31 in the case of polytopes. 

Proof. Assume that P is given by a set Hp = {hi, . . . ,hp/2} C and a set of parameters 
{/?!,..., %2} C N, i.e., 

P = {xe lC\{x, hi) < (3i and {x, -hi) < pi for all 1 < z < F/2]. 

As we have seen in Lemma [A. 131 P contains an Euclidean ball with radius minj{l/||/ij||2}. The 
radius min{l/||/ij||2|l < i < is at least ^/n/ size(P), since we have 

ll^ilb ^ y/ns\ze{hi) < \/nsize{P) 

for all 1 < 2 < -F/2, using the result from Lemma IA.5I That means, we have P C Bk >{0,{^- 
size(P))^i). 

Additionally, we have seen in Lemma lA. 141 that P is contained in a ball with radius y/n ■ n"/^ • 
size(P)". Using these results, the relation between the in- and circumscribed unit ball is at most 

V^-_n"/^size(Pr ^ ^n/2+i si^e(P)"+i < (n • size(P))"+i. 
{^/n ■ size(P))~^ 

Now, it follows from Theorem lA.lOl that there exists an algorithm A', that solves the closest 
vector problem with respect to the norm defined by the polytope P. 

Additionally, we have seen In Lemma I A . 1 2 1 that the norm || • ||p defined by the polytope P is 
(I'llji:! /3j)-enumerable. Since the parameters 1 < j < F/2, are integers, we have 

F/2 

n/3,<size(P)^/^ 
J=i 

with Lemma |A.5| we see that the length of each basis vector hi, \ < i < m, with respect to the 
norm || • \\p is at most 

||&«||p ^ n ■ size{B) ■ size(P). 
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Hence, we obtain that 

max{||6j ||p|l < j < m} < n ■ S ■ size(P). 
Now, it follows from Theorem IA.10| that the running time of the algorithm A' is at most 

F ■ n^(i) log2(P • S) ■ t4^2(16 • m3n"+2 size(P)"+i ■S^,n-m-S- size(P)), 

□ 

A. 4 Technical lemmata for the lattice membership algorithm 

Lemma A. 16. Let P C ]R" he a full- dimensional hounded polyhedron given hy m integral 
inequalities {ai,x) < fii where Oj G Z", /3j G Z for 1 < i < m, i.e., 

P = {x£ lR,"|(ai,x) < /3i for 1 <i <m} = {x G WlA^x < /?}, 

where A is the matrix which contains of the columns ai . Then 

P C {x G 1R"| - t < x{i) < t} with t = n"/V", 

where r is the representation size of the polyhedron. 

Proof. Let w G P be an arbitrary vertex of the polyhedron. Then there exists a nxn submatrix 
C of such that C ■ v = d, where d is the column vector which consists of the corresponding 
coefficients of b. Using Cramer's Rule, the coefficients Vi of the vertex v are given by 

_ det(a) 
det(C) ■ 

Here Cj is the nxn matrix C where the i-th column is replaced by d. Since is a matrix 
with integral coefficients, | det(C)| > 1 and we get for all coefficients 

\vi\ < |det(Ci)| < n"/2size(C7)", 

where the last inequality can be shown using Hadamard's inequality. This proves the lemma. □ 

A. 5 Technical lemmata for the flatness algorithm 
Theorem A. 17. ( Theorem 1 7. i^l restated) 

Let E C IR" he an ellipsoid. If the width of the ellipsoid is at least n, w(E) > n, then the 
ellipsoid contains an integer vector. 

Proof. We prove the contraposition: If the ellipsoid E(D, c) does not contain an integer vector, 
then every integer vector x G Z"* satisfies (x — c)^D~^{x — c) > 1. Since 

(x - cfD-\x -c) = {x- cfiQ^Q)-\x -c) = ||(Q^)-^x - (g^)-^c||^, 

the distance from the vector {Q^)~^c to the lattice £{{Q^)~^) is greater than 1. This implies that 
the covering radius of the lattice C{{Q'^)~^) is greater than 1, C{{Q'^)~^). Since C{{Q'^)^^) = 
C{Q)* , we obtain from the transference bound due to Banaszczyk |Ban93| that 

^>^,('\c{Qr)■^?\cm>^?\^Q))■ 

Since we have seen in Proposition 17.11 that the width of the ellipsoid is exactly 2A^ {C{Q)), it 
follows that w{E{D,c)) < n. □ 
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Claim A. 18. ( Claim FTJPI restated) Let F : R'" H be a function defined as in i\7.4\) given by 



a non-singular matrix V G (Q"^", a vector t G Q" and an,Cid S N. Let S be an upper bound on 
the representation size ofV~^, t, an and a^- Then, there exists an integer K < S"^" ^ such that 
K-F{x) G for allxe TH^ . 

Proof. Since anj^d S IN) we observe that F{x) ^TL\i all coefficients of the matrix V^^ and the 
vector t are integers. If y-i = [vij) £ Q"^" and t = (ti) G Q", then the coefficients of the 
vector V~^t are rationals of the form X]"=i Vijtj. That means, each coefficient is the sum of n 
rational numbers whose denominators are at most S'^. 

Hence, the multiplication of this vector with the product of these denominators yields an integer 
vector. The multiplication of with the same number yields an integer matrix. 
Hence, there exists a number, which is at most (5^)" = 5"^" such that V~^{{x'^ ,0"'~''^)"'" — t) 
becomes an integer if multiplied with this number. Since F consists of the p-th power of an 
£p-norm, there exists a number which is at most (S"^" Y = S*^" ^ such that F{x) becomes an 
integer if multiplied with this number. □ 

Lemma A. 19. f Lemma \7.12\ restated) Let y G IR" and 1 < p < oo. Then a subgradient g G IR"" 
of the function 

n 

Fp : ^ R, x^Y^ \xi\P 

i=l 

at the vector y is given by g = {g\, . . . , gn)^ , where 

gi := sign(yi) • 

Proof. Since Fp is a nonnegative combination of the functions x i— )• it is enogugh to consider 
the case, where n = 1. 

We will show that the vector g defined as above satisfies the subgradient inequality (|7.5p . For 
all z G IR and < A < 1 it follows from the convexity of the function Fp that 

Fp{y + \{z - y)) < (1 - \)Fp{y) + \Fp{z) 

or 

Fp{z) > J {Fp{y + Xiz - y)) - (1 - \)Fp{y)) = Fp{y) + i {Fp{y + X{z - y)) - Fp{y)) . 

Hence, it remains to show that 

Fp{y + X{z - y)) - Fp{y) > Asign(y) • \y\^'\z - y). 

By definition of Fp, we have Fp{y + \{z — y)) — Fp(y) = \y + X{z — y)\P — \y\P. Since for all 
a, 6 G IR, m G N, it holds that 6™ - a" = (6 - a) • ^™ 6™-^-*a*, we see that 

p-i 

\y + X{z -y)\P- \y\P = (|y + A(z - y)| - |y|) • ^ |y + A(z - y)r'-' ■ \y\' 
>{\y + X{z-y)\-\y\)\yr\ 
Since for all a, 6 G IR, \a\ — \b\ > sign(6) • (a — 6), this is at least A • sign{y){z — y) ■ \y\^^^- □ 
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Lemma A. 20. (Lemma \ 7.15\ restated) For m,n £ ¥\, m < n, a subgradient at the vector 
y e U"" of the function F : U"" U, x ^ a2||\^-i((x^, O""™)^ - t% - al, where V G 
j^nxn nonsingular, t G R," and \ < p < oo, is given by the vector a^g G R*" defined by 
9 = {V'Yg{i_m}, where 5 G R" ^s defined by g^ = sign{[V~\y - t)]i) ■ - // 

y G Bin\0,R) C R*^, then \\ 

a^slb ^ ^ ■ {oidnS"^ R}j^ , where S is an upper bound on the size 

of V^"^ and t. 

Proof. The correctness of the construction follows directly from Lemma 17.141 Since \\g\\2 < 
m-max{|5(j||l < i < m}, it is enough to compute an upper bound on the coefficient of the vector 

9- 

If V^^ = {vij)ij G Q*^^" and t = {ti)i G Q", the A;-th coefficient, 1 < < n, of the vector 
V^^{y — t) is given by 

n 

\[V'Hy-tM<J2\vkj-{yj-tj)\. 
i=i 

Since the coefficients of V^^ and t are at most S and since each coefficient of y is at most R (in 
absolute values), we obtain 

\[V'Hy-t)]k\ <n- S{R + S) < nRS\ 
Hence, each coefficient of the vector g is at most 

\9i\ < {nRSy. 

With the same argumentation, we obtain that each coefficient of the vector g is at most 

\g\ <n- S{nRSy < {nS^Rf+^. 

□ 

Lemma A. 21. Let D G Q"^" be a symmetric positive definite matrix. Let d € W" be the 
flatness direction of the ellipsoid defined by the matrix D. Then 

||d||2<n("+2)/2.gi,gp){n+l)/2_ 

In the proof of this lemma, we use that for every symmetric positive definite matrix A, there 
exists a uniquely determined symmetric positive definite matrix X such that A = X'^-X = X-X. 
We call X the square root of A, denoted by A^^"^ (see |HJ85j). 

Proof. To prove an upper bound on the length of the vector d, we observe that d = Q~^v, where 
f is a shortest non-zero lattice vector in C{Q) and that the length of d is the same as the length 
of a shortest vector in the lattice C{D^/'^), 

as we have seen in Proposition 17.11 Especially, the length of the vector d G is at most 

\\d\\2 = \\Q-'dh < \\Q-'\\ ■ \\dh = \\Q-'\\ • xfiD^'). (1.10) 

Using Minkowski's Theorem, see for example | ICas71) . the minimum distance of the lattice 

^(2)pi/2) < ^det(Z)i/2)i/n ^ ^det(D)V2". 
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Since the decomposition of a symmetric positive definite matrix in D = Q Q is unique up to 
multiplication with an orthogonal matrix, there exists an orthogonal matrix O G R"^" such 
that O ■ Q = Z)^/^. From this, one can show that the matrices = D^^^"^ ■ O and D~^^'^ have 
the same spectral norm: 

IIQ-^II = ^Vn{O^D-^0) = Vvn{D-^) = ^r/„,((Z?-V2)T^-i/2) = \\D-^/\ 

where rjn denotes the larget eigenvalue of the matrix. Combining this with (|1.10p and (|l.lip . we 
obtain the following upper bound for the length of the vector d, 

||d||2< V^P"'/'||-det(Z))V2n^ 
The spectral norm of the matrix ||Z?~^/^|| is given by square root of the spectral norm of D~^, 

where the spectral norm of is the inverse of an eigenvalue of D. It is easy to see, that 
each eigenvalue of the symmetric positive definite matrix is at least 1/ size(I?), see for example 
|Ye92] . Hence, we obtain that 

||Z)-i||^/'<size(I?)i/2 
and respectively the following upper bound for the length of d, 

\\d\\2 < V^det(D)^(i+^). 

The determinant det(L') is the product of its eigenvalues (see |Str06| ) and the size of each 
eigenvalue of the symmetric positive definite matrix is at most n ■ size(-D), see again |Ye92| . We 
obtain that 

det{D) < (n-size(L'))". 
Hence, the length of the vector d is at most 

\\d\\2 < V^{n • size(Z)))t(i+^) = ^(n • size(Z)))("+i)/2. 

□ 
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